Litestar ASGI Framework Vulnerable to Local File Inclusion (LFI) Attacks
CVE-2024-32982
What is CVE-2024-32982?
A Local File Inclusion vulnerability exists within the static file serving component of the Litestar and Starlite ASGI framework. This flaw allows attackers to exploit path traversal vulnerabilities, potentially gaining unauthorized access to sensitive files located outside the designated directories. The vulnerability stems from the file path handling within the static content serving function, particularly in the litestar/static_files/base.py file. Successful exploitation could lead to the disclosure of sensitive information or compromise the security of the server. The issue has been addressed in versions 2.8.3, 2.7.2, and 2.6.4, and users are advised to upgrade to the latest versions to mitigate risk.
Affected Version(s)
litestar >= 2.8.0, < 2.8.3 < 2.8.0, 2.8.3
litestar >= 1.37.0, <= 1.51.14 <= 1.37.0, 1.51.14
litestar >= 2.7.0, < 2.7.2 < 2.7.0, 2.7.2