| タイトル | chonkie-inc littrs <=0.62 Path Traversal |
|---|
| 説明 | SUMMARY
Path traversal in directory mounts allows sandboxed code to read and write arbitrary files on the host filesystem.
VENDOR: chonkie-inc
PRODUCT: littrs (crates.io)
AFFECTED VERSIONS: <= 0.6.2
VULNERABILITY CLASS: Path Traversal (CWE-22)
DETAILS
When a directory is mounted via Sandbox::mount(), the VM resolves file paths like this:
let host_path = format!("{}/{}", dm.host_dir, relative);
"relative" comes directly from the user-supplied argument to open() with no canonicalization and no check that the resolved path starts with dm.host_dir. This allows path traversal sequences like ../../../ to escape the mount boundary and access arbitrary locations on the host filesystem. The same unvalidated path is passed to fs::write at multiple call sites. The fix is to canonicalize the resolved path and verify it starts within the canonicalized mount root before opening.
The official rustdoc example for Sandbox::mount() itself demonstrates the vulnerable pattern (mounting "." against a real host directory, including with writable=true), confirming this is the documented, intended usage rather than an obscure edge case.
PROOF OF CONCEPT
#[test]
fn poc() {
use crate::sandbox::Sandbox;
std::fs::create_dir_all("/tmp/sb").unwrap();
let mut s = Sandbox::new();
s.mount(".", "/tmp/sb", false);
let r = s.run("open('../../../etc/passwd').read()").unwrap();
assert!(r.to_string().contains("root:"));
println!("{}", r);
}
This test, placed in crates/littrs/src/lib.rs of v0.6.2, successfully dumps /etc/passwd from the host.
IMPACT
Code running inside the littrs Sandbox can escape the mounted directory using relative path traversal. This allows reading arbitrary files on the host filesystem (sensitive files, configuration, secrets, SSH keys), and writing arbitrary files when writable=true is used (backdoors, cron modification, config overwrite, webshells). In an environment where untrusted or LLM-generated code is executed through littrs, this can lead to full host compromise.
DISCLOSURE HISTORY
I reported to the maintainer via GitHub Security Advisory GHSA-j65r-rjxh-fgc4 on 2026-05-04. As of this submission, 85+ days have passed with no maintainer response despite two direct follow-up emails and a comment on the GHSA thread.
CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
|---|
| ソース | ⚠️ https://github.com/chonkie-inc/littrs/security/advisories/GHSA-j65r-rjxh-fgc4 |
|---|
| ユーザー | SkinwalkerSec (UID 100216) |
|---|
| 送信 | 2026年07月30日 04:23 (2 月 ago) |
|---|
| モデレーション | 2026年09月24日 15:46 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 409349 [chonkie-inc littrs 0.6.1/0.6.2 crates/littrs/src/lib.rs Sandbox::mount relative ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|