Path Traversal Vulnerability in Pyrofork Allows Arbitrary File Writes
Summary
GHSA-6h2f-wjhf-4wjx: Pyrofork has a Path Traversal in download_media Method. Affects pyrofork versions < 2.3.69. Fixed in 2.3.69. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pyrofork is a Python library designed for interacting with Telegram's API, enabling developers to create bots and applications that can send and receive messages, manage media, and handle user interactions. The library's functionality includes downloading media files sent by users. However, a critical vulnerability exists in the way it handles filenames during the media download process, making it susceptible to path traversal attacks.
Vulnerability Detail
The vulnerability arises from the download_media method in Pyrofork, which fails to properly sanitize filenames received from Telegram messages. This oversight allows an attacker to craft a filename containing path traversal sequences (e.g., '../') or absolute paths, enabling them to write files to arbitrary locations on the filesystem. The issue is exacerbated by the fact that the file_name attribute is controlled by the message sender, leading to potential unauthorized access to sensitive areas of the filesystem. If exploited, this vulnerability could result in arbitrary file writes, potentially overwriting critical files or causing denial of service.
How To Fix
Minimum fixed version
2.3.69
This is the first release that contains the fix.
pip install --upgrade "pyrofork==2.3.69"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your bot specifies a custom filename when calling the download_media method. This can be done by passing a safe filename as a parameter, which does not contain any path traversal sequences or absolute paths.
Conclusion
The path traversal vulnerability in Pyrofork poses a significant risk to applications that utilize this library for downloading media. By failing to sanitize filenames, the library allows attackers to manipulate file paths, leading to potential unauthorized file writes. It is crucial for developers to update to the patched version and implement recommended fixes to safeguard their applications.
See every vulnerability recorded for pyrofork →
FAQ
The vulnerability is a path traversal issue that allows attackers to write files to arbitrary locations on the filesystem by exploiting the filename handling in the download_media method.
Any Telegram bots or user accounts using Pyrofork that download media without specifying a custom filename are affected.
Exploitation could lead to arbitrary file writes, overwriting existing files, causing denial of service, or even potential code execution in specific scenarios.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyrofork.
