Description
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rochacbruno marmite
Default version status: unaffected
0 to ≤ 0.4.2affected
pkg:cargo/marmiteReferences
- https://github.com/rochacbruno/marmite/issues/554 ↗
- https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/server.rs#L180-L315 ↗
- https://github.com/rochacbruno/marmite/commit/303a0bf2fff4302f4164c0c39932fdffc6683ad4 ↗
- https://github.com/rochacbruno/marmite ↗
- https://www.vulncheck.com/advisories/marmite-through-0.4.2-path-traversal-via-development-server ↗