Vulnerable code sample

import os
import tornado.ioloop
import tornado.web

# In a real application, this would be a configurable path.
# For this example, we assume it's a fixed directory.
MEDIA_ROOT = "/var/lib/motioneye/Camera1"

# This custom handler is created to serve media files.
# It inherits from Tornado's StaticFileHandler but overrides a key security method.
class UnsafeMediaFileHandler(tornado.web.StaticFileHandler):
    def validate_absolute_path(self, root, absolute_path):
        # This override is the core of the vulnerability.
        # Tornado's default implementation checks if `absolute_path` is within `root`
        # and raises an HTTP 403 error if it's not, preventing path traversal.
        # By simply returning the path without validation, this security check is bypassed.
        #
        # When a user provides an absolute path like '/etc/passwd', os.path.join(root, absolute_path)
        # results in '/etc/passwd', which is then returned here and served.
        return absolute_path

def make_app():
    return tornado.web.Application([
        # The handler is configured to serve files from the MEDIA_ROOT directory.
        # Any path matching /media/(.*) will be handled.
        # e.g., /media/2023-10-27/video.mp4 -> /var/lib/motioneye/Camera1/2023-10-27/video.mp4
        # e.g., /media//etc/passwd -> /etc/passwd (due to the vulnerability)
        (r"/media/(.*)", UnsafeMediaFileHandler, {"path": MEDIA_ROOT}),
    ])

if __name__ == "__main__":
    print("Starting vulnerable web server on http://localhost:8888")
    print(f"MEDIA_ROOT is '{MEDIA_ROOT}'")
    print("Try accessing http://localhost:8888/media/some_file.txt")
    print("Then try the exploit: http://localhost:8888/media//etc/passwd")
    app = make_app()
    app.listen(8888)
    tornado.ioloop.IOLoop.current().start()