CVE-2022-35920

Sanic allows directory traversal via encoded %2F URLs

• CVSS 7.5
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.

CVE

CVE-2022-35920

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.5

Published

2022-08-01

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Sanic to a version that fixes the vulnerability.

from sanic import Sanic

app = Sanic("App")

@app.static('/static', './static')

@app.get('/static/<path:path>')
async def serve_static(request, path):
    return await response.file(f'./static/{path}')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000)

from sanic import Sanic, response
from sanic.exceptions import NotFound
from pathlib import Path

app = Sanic("App")
static_dir = Path('./static').resolve()

@app.static('/static', str(static_dir))

@app.get('/static/<path:path>')
async def serve_static(request, path):
    file_path = (static_dir / path).resolve()
    if not file_path.is_file() or not str(file_path).startswith(str(static_dir)):
        raise NotFound("File not found or access denied")
    return await response.file(str(file_path))

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000)

@misc{vaitp:cve202235920,
  title        = {{Sanic allows directory traversal via encoded %2F URLs}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-35920},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-35920/}}
}