CVE-2023-40274
📋 TL;DR
This directory traversal vulnerability in Zola's built-in web server allows attackers to read arbitrary files outside the webroot directory. Anyone using 'zola serve' command in affected versions is vulnerable, potentially exposing sensitive system files.
💻 Affected Systems
- zola
📦 What is this software?
Zola by Getzola
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via reading sensitive files like /etc/passwd, SSH keys, configuration files, or database credentials, leading to privilege escalation or lateral movement.
Likely Case
Unauthorized reading of sensitive project files, configuration data, or system information from the server's filesystem.
If Mitigated
Limited to reading files within the webroot directory as intended, with no access to sensitive system files.
🎯 Exploit Status
Simple HTTP requests with ../ sequences can exploit this vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.18.0 and later
Vendor Advisory: https://github.com/getzola/zola/security/advisories
Restart Required: Yes
Instructions:
1. Update Zola to version 0.18.0 or later using your package manager. 2. Restart any running 'zola serve' instances. 3. Verify the update with 'zola --version'.
🔧 Temporary Workarounds
Disable zola serve
allStop using the vulnerable built-in web server and use alternative web servers
pkill -f 'zola serve'
systemctl stop zola-serve.service
Use alternative web server
allServe Zola-generated static files with nginx, Apache, or other production web servers
nginx -s reload
systemctl restart apache2
🧯 If You Can't Patch
- Restrict network access to zola serve instances using firewall rules
- Run zola serve with minimal privileges and in isolated containers/chroots
🔍 How to Verify
Check if Vulnerable:
Check if running 'zola serve' with version between 0.13.0 and 0.17.2 inclusiveCheck Version:
zola --versionVerify Fix Applied:
Confirm version is 0.18.0 or later and test with traversal attempts📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences
- Access to files outside expected webroot
Network Indicators:
- HTTP GET requests with URL-encoded ../ sequences
- Unusual file access patterns
SIEM Query:
source="web_logs" AND (url="*%2e%2e%2f*" OR url="*..%2f*")