Arbitrary File Access Vulnerability in rust-webbrowser Package
Summary
DEBIAN-CVE-2022-45299: An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL. Affects rust-webbrowser versions < 0.8.7-1. Fixed in 0.8.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-webbrowser package is a library that allows developers to open web browsers from Rust applications. It provides a simple interface for launching web browsers and interacting with them. However, a vulnerability has been identified in versions prior to 0.8.7-1, which allows attackers to exploit the IpFile argument, leading to unauthorized access to arbitrary files.
Vulnerability Detail
An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL. This vulnerability can lead to sensitive information disclosure and potential exploitation of the system where the application is running. The flaw originates from improper validation of input URLs, which can be manipulated by an attacker to point to local files.
How To Fix
Minimum fixed version
0.8.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rust-webbrowserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the IpFile argument in your application until the package is updated. Validate and sanitize all user inputs to prevent the injection of malicious URLs.
Conclusion
The rust-webbrowser package has a critical vulnerability that allows arbitrary file access through crafted URLs. It is essential to update to the patched version 0.8.7-1 to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for rust-webbrowser →
FAQ
The vulnerability allows attackers to access arbitrary files on the system, which can lead to data breaches and unauthorized access to sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions of rust-webbrowser prior to 0.8.7-1 are affected by this vulnerability.
Yes, a patched version 0.8.7-1 is available. Updating to this version will resolve the vulnerability.
If you cannot update the package, implement input validation and avoid using the IpFile argument as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust-webbrowser.
