Litestar und Starlite betroffen durch unzureichende Beschränkung eines Pfadnamens auf ein eingeschränktes Verzeichnis ('Path Traversal')

The core of this vulnerability lies in the static file serving component of Litestar. Attackers can leverage path traversal techniques to manipulate file paths, effectively bypassing intended directory restrictions. This allows them to access files located outside of the designated static content directory. The potential impact is significant, ranging from the disclosure of configuration files containing sensitive credentials to the retrieval of source code or other proprietary information. Successful exploitation could lead to a complete compromise of the server and its data, depending on the files accessed and the privileges of the Litestar process.

Applications and services built using Litestar, particularly those serving static content, are at risk. This includes deployments utilizing custom static file serving configurations or those with inadequate input validation. Shared hosting environments where multiple applications share the same server and file system are also particularly vulnerable.

• python / server:

import os
import requests

url = 'http://your-litestar-server/static/../../../../etc/passwd' # Example path traversal attempt
response = requests.get(url)

if response.status_code == 200:
    print('Potential vulnerability detected: Path traversal successful!')
    print(response.text)
else:
    print('Path traversal attempt failed.')

• linux / server:

journalctl -u litestar -f | grep "path traversal"

• generic web:

curl -I http://your-litestar-server/static/../../../../etc/passwd

Check the response headers for any unexpected content or errors.

1. 2024-05-06Disclosure

   disclosure

1. Reserviert2024-04-22
2. Veröffentlicht2024-05-06
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-32982 is to immediately upgrade to Litestar version 2.8.3 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block path traversal attempts. Specifically, look for patterns involving directory traversal sequences like ../ in incoming requests. Additionally, review and restrict file permissions on the static content directory to minimize the potential damage from unauthorized access. After upgrading, verify the fix by attempting to access files outside the designated static content directory; access should be denied.