Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:.
The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd…
security-advisories@github.com
https://github.com/pallets/werkzeug/pull/3309
security-advisories@github.com
https://github.com/pallets/werkzeug/releases/tag/3.1.9
security-advisories@github.com
https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m
security-advisories@github.com