GHSA-8v4j-7jgf-5rg9: Warp vulnerable to Path Traversal via Improper validation of Windows paths

January 31, 2023 (updated March 31, 2023)

Path resolution in warp::filters::fs::dir didn’t correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

References

github.com/advisories/GHSA-8v4j-7jgf-5rg9
github.com/seanmonstar/warp
github.com/seanmonstar/warp/commit/0074a0a3e98786509259bfe3821d3b3f094257aa
github.com/seanmonstar/warp/issues/937
github.com/seanmonstar/warp/pull/997
rustsec.org/advisories/RUSTSEC-2022-0082.html

Detect and mitigate GHSA-8v4j-7jgf-5rg9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →