Vulnerable code sample

#
# This code is a conceptual representation of the vulnerability described in
# a fictional CVE-2026-34515. It demonstrates how an aiohttp server on Windows,
# prior to a hypothetical patch, might leak an internal NTLMv2 remote path (UNC path)
# when handling requests for static files that do not exist.
#
# The vulnerability lies in how the error is handled and presented to the client.
# The actual vulnerable code in aiohttp would be inside its internal static
# file handler. This example uses a custom handler to simulate the flawed logic.
#
# DO NOT USE THIS CODE IN A PRODUCTION ENVIRONMENT.
# It is intended for educational purposes only to demonstrate a security vulnerability.
#
# To run this example:
# 1. pip install aiohttp
# 2. Run the Python script.
# 3. Open a web browser or use curl to access http://127.0.0.1:8080/static/non_existent_file.txt
#
# You will see an error message in the response that exposes the internal UNC path.
#

import asyncio
from aiohttp import web
import os

# --- Vulnerability Simulation ---
# This handler simulates the flawed behavior of the pre-patch static resource handler.

async def vulnerable_static_handler(request):
    """
    This handler mimics the vulnerability. It tries to access a file on a
    pre-configured UNC path and, upon failure, leaks the full path in the
    error response.
    """
    # In a real-world scenario, this base path would be configured when setting up the server.
    # It points to a remote Windows file share (UNC path).
    # We use a raw string (r'...') to handle the backslashes correctly.
    unc_base_path = r'\\SECRET-FILE-SERVER\company_share\assets'

    filename = request.match_info.get('filename', '')
    
    # Construct the full path to the resource on the remote share.
    full_remote_path = os.path.join(unc_base_path, filename)

    try:
        # VULNERABLE STEP 1: Attempt to access the resource.
        # We simulate this by checking if the path exists. In a real application,
        # this might be an open() call or a stat() call.
        # Since the UNC path is likely fake, this will almost certainly fail
        # and raise an exception.
        if not os.path.exists(full_remote_path):
             # The specific exception could vary, but FileNotFoundError is a likely candidate.
             # The key is that the exception message from the OS contains the path.
            raise FileNotFoundError(f"[WinError 2] The system cannot find the file specified: '{full_remote_path}'")

        # If the file existed, it would be served here.
        # For this PoC, we assume it never does.
        return web.Response(text="This text would not be seen.")

    except (FileNotFoundError, OSError) as e:
        # VULNERABLE STEP 2: The exception is caught, and its string representation
        # is sent directly to the client in the HTTP response.
        # The str(e) contains the full internal UNC path, which is the information leak.
        error_message = f"404 Not Found: Resource could not be accessed. Detail: {str(e)}"
        print(f"Leaking sensitive path in response: {full_remote_path}")
        return web.Response(text=error_message, status=404)


async def main():
    app = web.Application()

    # The server is configured to serve files from '/static/' using our vulnerable handler.
    # This simulates how `app.router.add_static()` might have behaved internally.
    app.router.add_get("/static/{filename:.*}", vulnerable_static_handler)

    print("Starting vulnerable aiohttp server on http://127.0.0.1:8080")
    print("Request a non-existent file to trigger the vulnerability:")
    print("  curl http://127.0.0.1:8080/static/some_document.pdf")
    print("-" * 60)
    
    runner = web.AppRunner(app)
    await runner.setup()
    site = web.TCPSite(runner, '127.0.0.1', 8080)
    await site.start()

    # Keep the server running
    while True:
        await asyncio.sleep(3600)

if __name__ == '__main__':
    try:
        asyncio.run(main())
    except KeyboardInterrupt:
        print("\nServer shutting down.")