cve@mitre.org reports:
WsgiDAV is a generic and extendable WebDAV server based on
WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path
containing an encoded parent-directory segment to escape the
configured filesystem share root in a specific path layout. The
issue is fixed with version 4.3.4.
WsgiDAV is a generic and extendable WebDAV server based on
WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in
wsgidav/samples/mysql_dav_provider.py concatenates the record key
parsed from a request URL directly into SQL WHERE clauses. The
affected _exists_record_by_primary_key, _get_field_by_primary_key,
and _get_record_by_primary_key methods are part of a shipped
example provider that is not enabled by default. An attacker who
can access a share explicitly configured with this non-default
provider can inject SQL through a normal GET request; anonymously
exposed read shares permit a status-code oracle and extraction of
arbitrary data reachable by the configured MySQL account. This
issue is fixed in version 4.3.5.
The WsgiDAV project reports:
When follow_symlinks is false (the default), WsgiDAV is expected
to prevent serving content through symbolic links - a request for
a symlink returns 403 Forbidden: Symlink support is disabled.
However, that guard inspects only the leaf component of the
resolved path, and the root-containment check is purely lexical
(os.path.abspath, which does not resolve symlinks).
As a result, a symlink used as an intermediate directory in the
request path is neither blocked by the guard nor caught by the
containment check, and the request escapes the configured share
root. This allows reading, writing, and deleting files outside the
root.