Listen to this Post
The vulnerability exists in Werkzeug’s `safe_join()` function, which is used by `send_from_directory()` to securely resolve user-supplied paths within a base directory. On Windows, filenames like CON, AUX, PRN, COM1, and `LPT1` are reserved device names. The `safe_join()` function’s validation logic incorrectly allows these names as path segments. When a malicious request asks for a file ending in such a name (e.g., /uploads/CON), the operating system successfully opens the corresponding device file instead of a regular file. Subsequent read operations on this device handle hang indefinitely, as the system waits for device-specific input. This causes a denial-of-service by permanently blocking the worker thread or process handling that request, consuming server resources until restart.
Platform: Werkzeug (Python)
Version: < 3.1.0
Vulnerability: Windows Device DoS
Severity: Critical
date: 2025-11-29
Prediction: Patch 2025-12-09
What Undercode Say:
curl "http://target/files/CON"
python -c "from werkzeug.utils import safe_join; print(safe_join('C:/webroot', 'CON'))"
import threading, requests; [threading.Thread(target=lambda: requests.get('http://localhost:5000/static/CON')).start() for _ in range(10)]
How Exploit:
Attackers send HTTP requests to endpoints using `send_from_directory` (e.g., /static/<path:filename>) with a trailing Windows device name like CON, AUX, or COM1. Each request causes a worker thread to block permanently. Repeating this exhausts available threads, leading to complete application unavailability (Denial-of-Service).
Protection from this CVE
Update to Werkzeug >= 3.1.0.
Implement WAF rules blocking device names.
Use non-Windows servers for deployment.
Sanitize user filename input.
Disable static file serving via `send_from_directory`.
Impact:
Application Denial-of-Service.
Resource exhaustion (threads/processes).
Windows deployment target only.
Requires path traversal vector.
High availability risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
