Rust OneNote File Parser Path Traversal Vulnerability Allowing Arbitrary File Access

A path traversal vulnerability has been identified in the Rust OneNote File Parser, specifically in versions prior to 1.1.1. The issue arises when the parser processes a maliciously crafted '.onetoc2' table-of-contents file. The vulnerability allows the parser to access arbitrary files on the host filesystem, outside the notebook's directory. This occurs because the parser does not properly validate entry names in the '.onetoc2' file, allowing for exploitation by joining these names with the notebook's base directory and potentially accessing sensitive files.

Impact

Exploitation of this vulnerability could lead to unauthorized access of files outside the OneNote notebook directory, with potential for file existence probing and denial-of-service through the use of large or special files.

Reproduction

To reproduce this vulnerability, use the 'Parser::parse_notebook' function on a '.onetoc2' file that has been crafted to include absolute paths or parent-directory components. The parser will resolve these entries against the notebook's base directory, bypassing normal path restrictions and allowing access to files outside the intended directory.

Remediation

Users can upgrade to version 1.1.1 of the Rust OneNote File Parser, which addresses the vulnerability by rejecting absolute paths, parent-directory components, and other invalid path characters in entry names. For those unable to upgrade, it is recommended to only parse '.onetoc2' files from trusted sources or to use 'Parser::parse_section' or 'Parser::parse_section_buffer' on individual '.one' files, which do not traverse directories.