CVE-2022-31534

GitHub repo echoleegroup/PythonWeb: Absolute path traversal via Flask send_file

• CVSS 9.3
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

CVE

CVE-2022-31534

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

9.3

Published

2022-07-11

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Fix by updating Flask and the echoleegroup/PythonWeb repository to the latest versions

from flask import Flask, send_file

app = Flask(__name__)

@app.route('/download/<path:filename>')
def download_file(filename):
    return send_file(filename)

if __name__ == '__main__':
    app.run()

from flask import Flask, send_file, abort, safe_join, send_from_directory
import os

app = Flask(__name__)

@app.route('/download/<path:filename>')
def download_file(filename):
    directory = os.path.join(app.root_path, 'files')
    path = safe_join(directory, filename)

    if not path.startswith(directory):
        abort(404)

    return send_file(path)

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202231534,
  title        = {{
GitHub repo echoleegroup/PythonWeb: Absolute path traversal via Flask send_file}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-31534},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-31534/}}
}