CVE-2023-29159 in Starlette
Summary
by MITRE • 06/01/2023
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/09/2025
The directory traversal vulnerability identified as CVE-2023-29159 affects Starlette web framework versions between 0.13.5 and 0.27.0, representing a critical security flaw that enables remote unauthenticated attackers to access arbitrary files on the underlying file system. This vulnerability stems from inadequate input validation and path handling within the framework's file serving mechanisms, creating an exploitable condition where maliciously crafted requests can traverse directory structures beyond the intended application boundaries. The flaw specifically impacts web services built using Starlette, which is a lightweight asynchronous web framework that serves as the foundation for many modern python web applications including FastAPI implementations.
The technical exploitation of this vulnerability occurs when the framework fails to properly sanitize user-supplied input that is used to construct file paths or determine resource locations. Attackers can manipulate request parameters containing directory traversal sequences such as '../' or similar path manipulation techniques to navigate outside the intended document root or application directory. This allows unauthorized access to sensitive files including configuration files, source code, database files, and other system resources that should remain protected from external access. The vulnerability operates at the application layer and does not require authentication credentials, making it particularly dangerous as it can be exploited by anyone with access to the affected web service.
The operational impact of CVE-2023-29159 extends beyond simple file disclosure to potentially expose critical system information that could aid in further exploitation attempts. An attacker who successfully exploits this vulnerability could gain access to application configuration files containing database credentials, API keys, and other sensitive information that could lead to additional compromises. The vulnerability affects the integrity and confidentiality of the web service, potentially exposing the entire application stack to unauthorized access and manipulation. Organizations running Starlette-based applications may face significant security risks including data breaches, system compromise, and potential regulatory compliance violations depending on the nature of the exposed data.
Organizations should immediately upgrade their Starlette framework installations to version 0.27.0 or later to remediate this vulnerability, as this represents the first fixed release that addresses the directory traversal flaw. The mitigation strategy should include comprehensive application security testing to identify any other potential path traversal vulnerabilities within the application stack, particularly in custom middleware or application code that might interact with file system operations. Security teams should also implement network-level protections including web application firewalls and access controls to limit exposure while patches are deployed. This vulnerability aligns with CWE-22 - Improper Limitation of a Pathname to a Restricted Directory and follows patterns commonly seen in the ATT&CK framework under the T1083 - File and Directory Discovery technique, where adversaries attempt to enumerate system resources to identify potential targets for further exploitation.