Dosage anfällig für ein Directory Traversal durch manipulierte HTTP-Antworten

The core of the vulnerability lies in how Dosage handles comic image downloads. When downloading images, the server constructs filenames based on various components of the comic, including the HTTP Content-Type header. While the basename is sanitized, the file extension is directly taken from this header. A malicious actor, or even a Man-in-the-Middle attacker intercepting HTTP traffic, can craft a request with a crafted Content-Type header to specify a file extension and path that allows them to write files outside the designated download directory. This could lead to overwriting critical configuration files, injecting malicious code, or exfiltrating sensitive data. The potential impact is significant, especially if the server is publicly accessible or handles sensitive comic content.

Systems running vulnerable versions of Dosage (≤3.1) are at risk, particularly those serving comics over HTTP rather than HTTPS, making them susceptible to Man-in-the-Middle attacks. Shared hosting environments where multiple users share the same Dosage instance are also at increased risk, as an attacker could potentially exploit the vulnerability to affect other users' files.

• python / server:

# Check for vulnerable versions of Dosage
python3 -c 'import dosage; print(dosage.__version__)'

• generic web:

# Check access logs for unusual file creation attempts or unexpected file extensions
grep -i 'Content-Type: image/.*' /var/log/apache2/access.log

1. 2025-11-04Disclosure

   disclosure

1. Reserviert2025-10-28
2. Veröffentlicht2025-11-04
3. Geändert2025-11-07
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade Dosage to version 3.2 or later, which includes a fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. One approach is to strictly validate and sanitize the Content-Type header received from the client, rejecting any requests with unexpected or suspicious values. Additionally, configure your web server to restrict file write access to the designated download directory, limiting the potential damage from a successful exploit. Regularly monitor server logs for unusual file creation or modification activity. After upgrading, confirm the fix by attempting a download with a crafted Content-Type header to ensure the server no longer allows arbitrary file writes.