Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Salvo's form data parsing implementations (formdata() method and Extractible macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service. Details Vulnerability Description Three attack vectors exist in Salvo's form handling: 1. URL-encoded form data (application/x-www-form-urlencoded) - Request::formdata() calls BodyExt::collect(body) which reads the entire body into memory without size checking - Affects handlers using req.formdata().await directly 2. Multipart form data (multipart/form-data) - Similar unbounded memory allocation during parsing - Affects handlers processing multipart uploads 3. Extractible macro - #[derive(Extractible)] with #[salvo(extract(defaultsource(from = "body")))] internally calls formdata() - Vulnerabilities propagate to all extractors using body sources Root Cause The…
Recommended action: Upgrade to 0.89.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Details A Path Traversal and Access Control Bypass vulnerability was discovered in the salvo-proxy component of the Salvo Rust framework (v0.89.2). The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encodeurlpath function, which fails to normalize "../" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the "." character. --- Technical Details If someone tries to attack by sending a special code like %2e%2e, Salvo changes it back to ../ when it first checks the path. The proxy then gets this plain ../ value. When making the new URL to send forward, the encodeurlpath function tries to change the path again, but its normal settings do not include the . (dot) character. Because of this, the proxy puts ../ straight into the new URL and sends a request like GET /api/../admin HTTP/1.1…
Recommended action: Upgrade to 0.89.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The function listhtml generates an file view of a folder which includes a render of the current path, in which its inserted in the HTML without proper sanitation, leading to reflected XSS. The request path is decoded and normalized in the matching stage but is not inserted raw in the HTML view (current.path). The only constraint here is for the root path (e.g., /files in the PoC example) to have a subdirectory (e. g., common ones like styles/scripts/etc.) so that the matching returns the list HTML page instead of the Not Found page. Details The vulnerable snippet of code is the following: dir.rs As seen here <title{}</title it is inserted unsafely. PoC https://github.com/user-attachments/assets/92a29a67-547b-40a5-af26-f1b0dd332702 Here is the example app, note this doesn’t need an upload feature (e.g to the other reported vulnerability), only the sub-folder is required. main.rs Cargo.toml Setup commands: Impact JavaScript execution, most likely leading to an account takeover,…
Recommended action: Upgrade to 0.88.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The function listhtml generates a file view of a folder without sanitizing the files or folders names, potentially leading to XSS in cases where a website allows access to public files using this feature, allowing anyone to upload a file. Details The vulnerable snippet of code is the following: dir.rs PoC https://github.com/user-attachments/assets/1e161e17-f033-4cc4-855b-43fd38ed1be4 Here is the example app we used: mian.rs Cargo.toml Impact JavaScript execution, most likely leading to an account takeover, depending on the site's constraint (CSP, etc…).
Recommended action: Upgrade to 0.88.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.