Wheels Framework Path Traversal Vulnerability

Executive Summary

This vulnerability affects Wheels software versions 4.0.0 to 4.1.2. It involves path containment checks that compare file paths case-insensitively on case-sensitive filesystems like Linux. This can allow unintended path traversal, where a path like /srv/app is treated as inside /srv/App. Attackers could exploit this to access files outside the intended root directory if sibling directories exist and are writable.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system runs Wheels versions 4.0.0 through 4.1.2. Use commands like 'pip show wheels' to verify the installed version. Inspect filesystem paths for case-sensitive checks that may allow unintended access. Look for symlinks or sibling directories with case-different names that could bypass containment checks.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain limited file disclosure or write files outside the intended application root directory. This requires specific conditions like existing writable sibling directories with case-different names or symbolic links pointing outside the root. The impact is limited due to the need for these conditions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wheels to version 4.2.0 or later immediately. Avoid using sibling directories with case-different names or symbolic links pointing outside the root. Disable development tools outside development environments and keep the CLI gate password secret if applicable.

Useful 0 Not Useful 0