CVE-2023-40587: Pyramid static view path traversal up one directory
Impact
This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html.
Example:
config.addstaticview(name='static', path='/usr/src/app/static', cachemaxage=0)
And directory tree:
/usr/src/app \ | - static \ | - file.css | - index.html | - ... | - index.html <-- (this file could be disclosed with this bug)
Patches
Pyramid now will reject any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories.
Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version, see:
- https://github.com/python/cpython/issues/106242 - https://github.com/python/cpython/pull/106816
At the time the following Python versions are not fixed:
- Python 3.11.0 to 3.11.4 - Python 3.12.0a1 to 3.12.0rc1
Fixes will be available in: Python 3.12.0rc2 or 3.11.5.
Please note that release candidates of Python are not production ready and should not be used for production workloads.
Workarounds
Use a version of Python 3 that is not affected. Downgrade to Python 3.10 series temporarily, or wait till Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
References
- https://owasp.org/www-community/attacks/PathTraversal - VN: JVN#41113329 - TN: JPCERT#93311166
Thanks
- Masashi Yamane of LAC Co., Ltd
Other sources
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is index.html. Pyramid version 2.0.2 rejects any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories. Secondly, Python 3.11, and 3.12 has fixed the underlying issue in os.path.normpath to no longer truncate on the first 0x00 found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version. Fixes will be available in:Python 3.12.0rc2 and 3.11.5. Some workarounds are available. Use a version of Python 3 that is not affected, downgrade to Python 3.10 series temporarily, or wait until Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2023-40587.
What is the impact of this vulnerability?
This vulnerability allows for path traversal, potentially exposing sensitive files and data.
Which versions of Pyramid are affected by this vulnerability?
Pyramid versions 2.0 to 2.0.2 are affected by this vulnerability.
What is the severity rating of this vulnerability?
This vulnerability has a severity rating of 5.3, which is considered medium.
How can I fix this vulnerability?
To fix this vulnerability, upgrade to a version of Pyramid that is later than 2.0.2.