Vulnerable code sample

import os
from flask import Flask, send_file, abort

# This is a simplified representation of a web application like Tautulli.
# The code demonstrates the path traversal vulnerability described in the CVE.
# It is NOT the actual source code from Tautulli but is designed to
# functionally represent the described flaw.

app = Flask(__name__)

# --- Setup vulnerable environment ---
# In a real Tautulli instance, this 'data' directory would already exist.
# We create it here for a self-contained, runnable example.
# It simulates the directory structure where sensitive files are stored
# alongside legitimate public-facing images.

DATA_ROOT = os.path.abspath('data')
IMAGE_DIR = os.path.join(DATA_ROOT, 'images')

if not os.path.exists(IMAGE_DIR):
    os.makedirs(IMAGE_DIR)

# Create a dummy config.ini file that the attacker wants to steal.
with open(os.path.join(DATA_ROOT, 'config.ini'), 'w') as f:
    f.write('[main]\n')
    f.write('api_key = a_very_secret_plex_token\n')
    f.write('jwt_secret = another_super_secret_string\n')
    f.write('admin_hash = a_bcrypt_or_sha1_hashed_password\n')

# Create a dummy database file.
with open(os.path.join(DATA_ROOT, 'tautulli.db'), 'w') as f:
    f.write('SQLite format 3\n')
    f.write('...some binary data...\n')
    f.write('...eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4ifQ.s_some_active_jwt_token...\n')

# Create a legitimate image file for intended use.
with open(os.path.join(IMAGE_DIR, 'background.jpg'), 'w') as f:
    f.write('pretend this is image data')

# --- Vulnerable Code ---
@app.route('/image/<path:filename>')
def get_image(filename):
    """
    This endpoint is intended to serve images from the 'data/images' directory.
    It is unauthenticated.

    THE VULNERABILITY:
    The user-provided 'filename' is directly joined with the base path.
    No sanitization or path validation is performed. An attacker can provide
    a 'filename' like '../../config.ini' to traverse directories and access
    files outside of the intended IMAGE_DIR.
    """
    # Vulnerable line: User input is directly used to construct a file path.
    file_path = os.path.join(IMAGE_DIR, filename)

    # The application checks if the constructed path exists and is a file.
    # However, it doesn't check if the resolved path is still within the
    # intended IMAGE_DIR. This allows the traversal to succeed.
    if os.path.isfile(file_path):
        try:
            return send_file(file_path)
        except Exception as e:
            # In a real app, this might be logged.
            print(f"Error sending file: {e}")
            abort(500)
    else:
        # If the file doesn't exist, return a 404.
        abort(404)

if __name__ == '__main__':
    print("Vulnerable server starting on http://127.0.0.1:8181")
    print("Demonstrate the vulnerability by accessing:")
    print("  - Legitimate image: http://127.0.0.1:8181/image/background.jpg")
    print("  - Traversal to config.ini: http://127.0.0.1:8181/image/../../config.ini")
    print("  - Traversal to tautulli.db: http://127.0.0.1:8181/image/../../tautulli.db")
    # Note: In a real deployment, Tautulli might run on a different port.
    # We use 8181 as it's the default Tautulli port.
    app.run(host='0.0.0.0', port=8181)