CVE-2022-31575

GitHub repository duducosmos/livro_python: Absolute path traversal via Flask send_file

• CVSS 9.3
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

CVE

CVE-2022-31575

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

9.3

Published

2022-07-11

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Fix by updating Flask and the duducosmos/livro_python repository to the latest versions

from flask import Flask, send_file

app = Flask(__name__)

@app.route('/download/<path:filename>')
def download_file(filename):
    return send_file(filename)

if __name__ == '__main__':
    app.run()

from flask import Flask, send_file, abort, join, send_from_directory
import os

app = Flask(__name__)

@app.route('/download/<path:filename>')
def download_file(filename):
    directory = '/path/to/directory'
    
    path = join(directory, filename)

    if os.path.isfile(path):
        return send_file(path)
    else:
        abort(404)

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202231575,
  title        = {{GitHub repository duducosmos/livro_python: Absolute path traversal via Flask send_file}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-31575},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-31575/}}
}