Path Traversal in Plack::Middleware::XSendfile

Executive Summary

This vulnerability exists in Plack::Middleware::XSendfile versions through 1.0053 for Perl. It allows a malicious client to control path rewriting by setting the X-Sendfile-Type header to "X-Accel-Redirect" and manipulating the X-Accel-Mapping header. This can cause the middleware to map the path to an arbitrary file on the server, potentially exposing unintended files.

The issue arises because the middleware allows the client to specify the sendfile type via headers if not properly restricted in the middleware constructor or environment. Although some mitigations exist, such as disallowing regular expressions in the mapping and applying the mapping only for the "X-Accel-Redirect" type, the vulnerability still permits client-controlled path rewriting.

This vulnerability is similar to CVE-2025-61780 affecting Rack::Sendfile, but with some differences in mitigation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the manipulation of the X-Sendfile-Type and X-Accel-Mapping headers by a client to perform path rewriting. Detection can focus on monitoring HTTP requests for unusual or unexpected values in these headers.

• Inspect incoming HTTP requests for the presence of the X-Sendfile-Type header set to "X-Accel-Redirect".
• Check for the X-Accel-Mapping header in requests, especially if it maps to arbitrary or suspicious file paths.
• Use network traffic capture tools like tcpdump or Wireshark to filter HTTP headers containing these values.
• Example command to capture HTTP headers with tcpdump: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i -E 'X-Sendfile-Type|X-Accel-Mapping'
• On the server, review web server or application logs for requests containing these headers with suspicious values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a malicious client to access arbitrary files on the server by manipulating the X-Sendfile-Type and X-Accel-Mapping headers. This could lead to unauthorized disclosure of sensitive information or files that should be protected.

Useful 0 Not Useful 0

Compliance Impact

The provided context and resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include preventing clients from controlling the X-Sendfile-Type and X-Accel-Mapping headers and upgrading the affected module.

• Upgrade Plack::Middleware::XSendfile to a version later than 1.0053 or remove it, as it is deprecated and planned for removal in future releases.
• Configure the middleware constructor or Plack environment to disallow client control over the X-Sendfile-Type header.
• If using nginx as a reverse proxy, ensure it properly validates or strips these headers from client requests to prevent misuse.
• Monitor and filter incoming HTTP requests to block those with suspicious X-Sendfile-Type or X-Accel-Mapping headers.

Useful 0 Not Useful 0