Vulnerability Report: GO-2022-0355
- CVE-2022-21221, GHSA-fx95-883v-4q4h
- Affects: github.com/valyala/fasthttp
- Published: Jul 27, 2022
- Modified: Jun 12, 2023
The fasthttp.FS request handler is vulnerable to directory traversal attacks on Windows systems, and can serve files from outside the provided root directory. URL path normalization does not handle Windows path separators (backslashes), permitting an attacker to construct requests with relative paths.
Affected Packages
-
PathVersionsSymbols
-
before v1.34.0
196 affected symbols
- AppendBrotliBytes
- AppendBrotliBytesLevel
- AppendDeflateBytes
- AppendDeflateBytesLevel
- AppendGunzipBytes
- AppendGzipBytes
- AppendGzipBytesLevel
- AppendHTTPDate
- AppendInflateBytes
- AppendUnbrotliBytes
- Args.WriteTo
- Client.CloseIdleConnections
- Client.Do
- Client.DoDeadline
- Client.DoRedirects
- Client.DoTimeout
- Client.Get
- Client.GetDeadline
- Client.GetTimeout
- Client.Post
- Cookie.AppendBytes
- Cookie.Cookie
- Cookie.Parse
- Cookie.ParseBytes
- Cookie.String
- Cookie.WriteTo
- Dial
- DialDualStack
- DialDualStackTimeout
- DialTimeout
- Do
- DoDeadline
- DoRedirects
- DoTimeout
- FS.NewRequestHandler
- FSHandler
- FileLastModified
- GenerateTestCertificate
- Get
- GetDeadline
- GetTimeout
- HostClient.CloseIdleConnections
- HostClient.Do
- HostClient.DoDeadline
- HostClient.DoRedirects
- HostClient.DoTimeout
- HostClient.Get
- HostClient.GetDeadline
- HostClient.GetTimeout
- HostClient.Post
- LBClient.Do
- LBClient.DoDeadline
- LBClient.DoTimeout
- ListenAndServe
- ListenAndServeTLS
- ListenAndServeTLSEmbed
- ListenAndServeUNIX
- NewStreamReader
- ParseByteRange
- ParseHTTPDate
- ParseIPv4
- PipelineClient.Do
- PipelineClient.DoDeadline
- PipelineClient.DoTimeout
- PipelineClient.PendingRequests
- Post
- Request.Body
- Request.BodyGunzip
- Request.BodyInflate
- Request.BodyUnbrotli
- Request.BodyWriteTo
- Request.ContinueReadBody
- Request.ContinueReadBodyStream
- Request.Host
- Request.MultipartForm
- Request.PostArgs
- Request.Read
- Request.ReadBody
- Request.ReadLimitBody
- Request.SetBodyStreamWriter
- Request.SetHost
- Request.SetHostBytes
- Request.String
- Request.SwapBody
- Request.URI
- Request.Write
- Request.WriteTo
- RequestCtx.FormFile
- RequestCtx.FormValue
- RequestCtx.Host
- RequestCtx.IfModifiedSince
- RequestCtx.MultipartForm
- RequestCtx.Path
- RequestCtx.PostArgs
- RequestCtx.PostBody
- RequestCtx.QueryArgs
- RequestCtx.Redirect
- RequestCtx.RedirectBytes
- RequestCtx.SendFile
- RequestCtx.SendFileBytes
- RequestCtx.SetBodyStreamWriter
- RequestCtx.String
- RequestCtx.URI
- RequestHeader.Add
- RequestHeader.AddBytesK
- RequestHeader.AddBytesKV
- RequestHeader.AddBytesV
- RequestHeader.Read
- RequestHeader.ReadTrailer
- RequestHeader.Set
- RequestHeader.SetByteRange
- RequestHeader.SetBytesK
- RequestHeader.SetBytesKV
- RequestHeader.SetBytesV
- RequestHeader.SetCanonical
- RequestHeader.SetReferer
- RequestHeader.SetRefererBytes
- RequestHeader.Write
- Response.Body
- Response.BodyGunzip
- Response.BodyInflate
- Response.BodyUnbrotli
- Response.BodyWriteTo
- Response.Read
- Response.ReadBody
- Response.ReadLimitBody
- Response.SendFile
- Response.SetBodyStreamWriter
- Response.String
- Response.SwapBody
- Response.Write
- Response.WriteDeflate
- Response.WriteDeflateLevel
- Response.WriteGzip
- Response.WriteGzipLevel
- Response.WriteTo
- ResponseHeader.Add
- ResponseHeader.AddBytesK
- ResponseHeader.AddBytesKV
- ResponseHeader.AddBytesV
- ResponseHeader.AppendBytes
- ResponseHeader.Cookie
- ResponseHeader.DelClientCookie
- ResponseHeader.DelClientCookieBytes
- ResponseHeader.Header
- ResponseHeader.Read
- ResponseHeader.ReadTrailer
- ResponseHeader.Set
- ResponseHeader.SetBytesK
- ResponseHeader.SetBytesKV
- ResponseHeader.SetBytesV
- ResponseHeader.SetCanonical
- ResponseHeader.SetContentRange
- ResponseHeader.SetCookie
- ResponseHeader.SetLastModified
- ResponseHeader.String
- ResponseHeader.Write
- ResponseHeader.WriteTo
- SaveMultipartFile
- Serve
- ServeConn
- ServeFile
- ServeFileBytes
- ServeFileBytesUncompressed
- ServeFileUncompressed
- ServeTLS
- ServeTLSEmbed
- Server.AppendCert
- Server.AppendCertEmbed
- Server.ListenAndServe
- Server.ListenAndServeTLS
- Server.ListenAndServeTLSEmbed
- Server.ListenAndServeUNIX
- Server.Serve
- Server.ServeConn
- Server.ServeTLS
- Server.ServeTLSEmbed
- Server.Shutdown
- TCPDialer.Dial
- TCPDialer.DialDualStack
- TCPDialer.DialDualStackTimeout
- TCPDialer.DialTimeout
- URI.Parse
- URI.Update
- URI.UpdateBytes
- URI.WriteTo
- WriteBrotli
- WriteBrotliLevel
- WriteDeflate
- WriteDeflateLevel
- WriteGunzip
- WriteGzip
- WriteGzipLevel
- WriteInflate
- WriteMultipartForm
- WriteUnbrotli
Aliases
References
- https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1
- https://github.com/valyala/fasthttp/issues/1226
- https://github.com/valyala/fasthttp/releases/tag/v1.34.0
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866
- https://vuln.go.dev/ID/GO-2022-0355.json
Credits
- egovorukhin
Feedback
See anything missing or incorrect?
Suggest an edit to this report.