Listen to this Post
The safe_join function in Werkzeug is intended to securely join path segments to prevent directory traversal attacks. However, on Windows systems, it improperly validates path segments containing reserved device names. Windows has special device names like CON, AUX, and others that are accessible as files in every directory. The vulnerability occurs because safe_join does not strip or check for file extensions or trailing spaces appended to these device names. For instance, paths like CON.txt, CON.txt.html, or “CON ” (with trailing spaces) are not recognized as device names. When send_from_directory uses safe_join to serve files based on user input, a requested path ending with such a device name causes the application to open the device file. On Windows, reading from these device files blocks indefinitely, leading to a denial of service. The previous fix for GHSA-hgf8-39gv-g3f2 only addressed simple extensions, missing compound extensions, trailing spaces, and additional special names, thus leaving the vulnerability unresolved.
Platform: Werkzeug
Version: Multiple versions
Vulnerability: Device name bypass
Severity: Medium
date: Unknown
Prediction: Patch date unknown
What Undercode Say:
Analytics:
pip show werkzeug curl -v http://localhost:5000/download/CON.txt.html
from werkzeug.utils import safe_join
Vulnerable safe_join usage example
path = safe_join('base_dir', 'CON.txt')
How Exploit:
Request paths with Windows device names having extensions or trailing spaces, e.g., /files/CON.txt.html, to trigger indefinite hangs in send_from_directory on Windows servers.
Protection from this CVE
Update Werkzeug to patched versions; implement custom path validation stripping extensions and spaces from device names.
Impact:
Denial of service via application hang on Windows deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
