Fiber Path Traversal Vulnerability Allowing Arbitrary File Read on Windows

A path traversal vulnerability has been identified in the Fiber web framework, specifically in versions 3.0.0 and prior. This vulnerability allows remote attackers to bypass the static middleware's file path sanitation, enabling them to read arbitrary files from the server's file system on Windows. The issue arises because the sanitizer does not properly handle double-encoded backslashes, which can be exploited to traverse directories and access sensitive files outside the web root.

Impact

Exploitation of this vulnerability allows for arbitrary file read on the affected server, potentially leading to the disclosure of sensitive information such as application secrets, configuration files, or system files, depending on the server's file permissions and configuration.

Reproduction

The vulnerability can be reproduced by sending a request to a Fiber application that uses the static middleware on a Windows server. The request must include a path that exploits the backslash handling, such as a double-encoded backslash traversal sequence. This can be done by encoding the backslash character twice, which the sanitizer will decode and use to traverse the directory structure.

Remediation

Users are advised to update Fiber to version 3.1.0 or later, where this vulnerability has been patched.