Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A GET request for a static file served by actix-files with an empty Range header triggers a panic. With panic = "abort", a remote user may crash the process on-demand. Details actix-files assumes that HttpRange::parse(), when Ok, always returns a vector with at least one element. When parse() is called on an empty string, it returns Ok(vec![]). This can cause a panic at named.rs:534 when handling an HTTP request with an empty Range: header. This shouldn't significantly impact programs built with the default panic = "unwind", as the only effect is that the connection is closed when the worker thread panics and new threads are spooled up on demand. Programs built with panic = "abort" are vulnerable to being crashed on-demand by any user with permissions to perform a GET request for a static file served by actix-files. https://github.com/actix/actix-web/blob/0383f4bdd1210e726143ca1ebcf01169b67a4b6c/actix-files/src/named.rs#L530-L535 PoC <details <summaryMinimal…
Recommended action: Upgrade to 0.6.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When passing a non-existing folder to the actixfiles::Files::new() method causes the actix server to expose unexpected files. Details The actix-files library exposes a Files struct that configures an actix service to serve the files in a folder as static assets. Below you can find the signature of the Files::new method: When the mountpath you pass to Files doesn't exist, it defaults to an empty path (Path::new()). When the service receives a HTTP request, it joins the request information with the empty path and calls canonicalize. Rust resolves this path as relative and returns any file that matches it. This behavior causes the library to expose unexpected files when the folder is not present. PoC There is a working PoC on https://github.com/Angelmmiguel/actix-files-vuln, although the next steps can be followed to reproduce the issue 1. Clone the https://github.com/actix/examples repository. 2. Change your directory to the basics/static-files folder. 3. Edit the src/main.rs…
Recommended action: Upgrade to 0.6.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.