Path Traversal in rustypaste via Filename Header

Executive Summary

This is a path traversal vulnerability in rustypaste versions before 0.18.1. The application fails to properly validate the destination path when using a custom filename HTTP header. Attackers can include path traversal sequences like '../' in the filename header to write files outside the intended upload directory to arbitrary locations on the server.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if you are running rustypaste versions before 0.18.1. Use commands like 'rustypaste --version' or inspect package managers for installed versions. Monitor logs for failed file upload attempts or path traversal patterns in filenames.

Useful 0 Not Useful 0

Impact Analysis

An attacker could overwrite critical system files such as SSH keys, cron jobs, or application configurations. This could lead to full server compromise, unauthorized data access, or disruption of services. The impact severity is high, especially for unauthenticated users or those with upload tokens.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosure of sensitive information, and failure to maintain secure processing environments.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rustypaste to version 0.18.1 or later immediately. Review and restrict file upload permissions. Implement strict input validation for filenames. Monitor for suspicious file writes outside the upload directory.

Useful 0 Not Useful 0