PT-2024-25030 · Litestar · Litestar

Brian-Edgar-Re · Published 2024-05-06 · Updated 2024-05-06 · CVE-2024-32982

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.8.3 Litestar versions prior to 2.7.2 Litestar versions prior to 2.6.4

Description A Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of Litestar, allowing attackers to exploit path traversal flaws and gain unauthorized access to sensitive files outside the designated directories. This vulnerability is located in the file path handling mechanism within the static content serving function, specifically at litestar/static files/base.py. The vulnerability enables attackers to access sensitive information, potentially compromise the server, and may lead to the exposure of sensitive information or further attacks.

Recommendations For versions prior to 2.8.3, update to version 2.8.3 or later. For versions prior to 2.7.2, update to version 2.7.2 or later. For versions prior to 2.6.4, update to version 2.6.4 or later. As a temporary workaround, consider implementing rigorous input validation and sanitization mechanisms for file path inputs, and normalizing file paths before using them in file operations to prevent directory traversal.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-32982

GHSA-83PV-QR33-2VCF

Affected Products

Litestar

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32982.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32982 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32982 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-83pv-qr33-2vcf · Vendor Advisory
• https://github.com/litestar-org/litestar · Note
• https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b · Note
• https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70 · Note
• https://github.com/litestar-org/litestar/commit/a07b79b84d8717bec5ac4d4674c1e4920ba9c813 · Note
• https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf · Note
• https://twitter.com/CveFindCom/status/1787553517357412359 · Twitter Post
• https://twitter.com/CVEnew/status/1787510782747398179 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1787522800099471549 · Twitter Post