Litestar e Starlite afetados por Limitação Inadequada de um Caminho para um Diretório Restrito ('Path Traversal')

The core of this vulnerability lies in the static file serving component of Litestar. Attackers can leverage path traversal techniques, such as using sequences like ../, to navigate outside the intended static file directories. This unauthorized access can expose sensitive configuration files, source code, or other critical data stored on the server. Successful exploitation could lead to information disclosure, potentially enabling further attacks, such as privilege escalation or remote code execution if sensitive credentials or scripts are exposed. The blast radius extends to any data accessible through the server's file system, depending on the attacker's ability to manipulate file paths.

Applications and services built using Litestar, particularly those serving static content, are at risk. This includes deployments utilizing custom static file serving configurations or those with inadequate input validation. Shared hosting environments where multiple applications share the same server and file system are also particularly vulnerable.

• python / server:

import os
import requests

url = 'http://your-litestar-server/static/../../../../etc/passwd' # Example path traversal attempt
response = requests.get(url)

if response.status_code == 200:
    print('Potential vulnerability detected: Path traversal successful!')
    print(response.text)
else:
    print('Path traversal attempt failed.')

• linux / server:

journalctl -u litestar -f | grep "path traversal"

• generic web:

curl -I http://your-litestar-server/static/../../../../etc/passwd

Check the response headers for any unexpected content or errors.

1. 2024-05-06Disclosure

   disclosure

1. Reservado2024-04-22
2. Publicada2024-05-06
3. Modificada2024-08-02
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-32982 is to upgrade to Litestar version 2.8.3 or later, which contains the fix for the path traversal vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. These may include restricting access to the static file serving endpoint using a Web Application Firewall (WAF) or proxy server, configuring strict file access controls on the server, and carefully reviewing the file paths used in the application to ensure they are properly sanitized. Monitor access logs for suspicious file requests containing path traversal sequences. After upgrading, confirm the fix by attempting a path traversal attack on the static file serving endpoint and verifying that access is denied.