CVE-2024-49766
📋 TL;DR
This vulnerability in Werkzeug's safe_join() function on Windows with Python < 3.11 allows UNC path bypass, potentially enabling directory traversal attacks. Attackers could access files outside intended directories. Only affects Windows systems running Python < 3.11 with vulnerable Werkzeug versions.
💻 Affected Systems
- Werkzeug
📦 What is this software?
Werkzeug by Palletsprojects
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized file read access to sensitive system files or application data through directory traversal
Likely Case
Limited file disclosure from web-accessible directories if specific conditions are met
If Mitigated
No impact with proper input validation or updated components
🎯 Exploit Status
Exploitation requires specific conditions: Windows, Python < 3.11, and vulnerable Werkzeug version. No public exploits known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.6
Vendor Advisory: https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j
Restart Required: Yes
Instructions:
1. Update Werkzeug: pip install --upgrade werkzeug==3.0.6
2. Restart the application/service
3. Verify the update with: pip show werkzeug
🔧 Temporary Workarounds
Upgrade Python to 3.11+
windowsUpgrade Python to version 3.11 or higher where os.path.isabs() properly handles UNC paths
Input validation wrapper
allImplement custom validation to reject UNC paths before safe_join()
🧯 If You Can't Patch
- Deploy web application firewall (WAF) rules to block UNC path patterns
- Restrict file system permissions for the application user to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check Python version: python --version
Check Werkzeug version: pip show werkzeug | grep Version
If Python < 3.11 on Windows and Werkzeug < 3.0.6, system is vulnerableCheck Version:
pip show werkzeug | grep VersionVerify Fix Applied:
Verify Werkzeug version is 3.0.6+: pip show werkzeug | grep Version
Test with sample UNC path input to ensure safe_join() rejects it📡 Detection & Monitoring
Log Indicators:
- UNC path patterns in request logs (//server/share)
- Failed file access attempts outside expected directories
Network Indicators:
- Unusual file access patterns from web endpoints
SIEM Query:
source="web_logs" AND ("//" OR "\\\\") AND path="*"