Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are commonly published without authentication, an anonymous attacker can read arbitrary data from the backing database. Confirmed locally with a boolean oracle and full data extraction. Note: The MySQLBrowserProvider module is only provided as an example for WsgiDAV and not enabled by default. Installations that do not explicitly activate the module in their configuration are not affected by this vulnerability. Details A path like /db/users/1 is split into a table name and a key. The table name is validated against the real table list, but the key is dropped directly into the query. For the configured table the resulting statement is SELECT id FROM testdb.users WHERE id = '<key', so a single…
Recommended action: Upgrade to 4.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Patches The issue is fixed with version 4.3.4. Preconditions The practical impact depends on the deployment. The deployment uses a filesystem-backed WsgiDAV share. The attacker can send WebDAV requests accepted by that share. This may be an anonymous share or an authenticated WebDAV user. This is not an authentication bypass. Details The issue is in FilesystemProvider.loctofilepath(). The method builds a candidate path with os.path.abspath(os.path.join(rootpath, pathparts)), then checks containment with filepath.startswith(rootpath). This is not path-boundary aware. For example, if the configured share root is /tmp/share, a resolved sibling path such as /tmp/shareevil/secret.txt still starts with the string /tmp/share. In a local proof, this allowed GET, PUT, and DELETE requests to operate on files outside the…
Recommended action: Upgrade to 4.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. Patches Users can upgrade to v4.1.0 Workarounds Set dirbrowser.enable = False in the configuration. For instance, when using a Python dictionary to configure the library: For more information Note that an attacker cannot exploit this vulnerability, by simply uploading a file or folder with a manipulated file name. However if the WsgiDAV library is used in a scenario where untrusted data is displayed in the directory browser's user interface (e.g. 'realm' or user name, ...) XSS may happen. If you have any questions or comments about this advisory: Open an issue in mar10/wsgidav See the security policy
Recommended action: Upgrade to 4.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.