CVE-2024-32982

Executive Summary

CVE-2024-32982 is a Local File Inclusion (LFI) vulnerability in the Litestar and Starlite ASGI frameworks, affecting versions prior to 2.8.3, 2.7.2, and 2.6.4. The flaw resides in the static file serving component, specifically in the file path handling mechanism within litestar/static_files/base.py. An attacker can exploit path traversal sequences (e.g., ../) to read arbitrary files outside the designated static directories, leading to unauthorized disclosure of sensitive information such as configuration files, source code, or credentials. The vulnerability has a CVSS score of 8.2 (High) due to its network exploitability, low attack complexity, and high confidentiality impact. No public proof-of-concept (PoC) or exploit code has been released as of this analysis, but the risk remains significant for unpatched deployments.

Supply Chain & Package Security

Litestar is a Python ASGI framework distributed via PyPI. Organizations using Litestar should verify their dependency versions and ensure they are updated to patched releases. The vulnerability affects the core static file serving logic, which is a common component in web applications. Supply chain risk is elevated if applications rely on outdated versions, as attackers may target known vulnerable instances. No malicious packages or backdoors have been reported in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can lead to full disclosure of sensitive server-side files.

Deep Dive & Mechanics

The vulnerability is located in the static file serving endpoint of Litestar. When a request is made to serve a static file, the framework constructs a file path by concatenating the base static directory with the user-supplied path. The flaw arises from insufficient sanitization of the user-supplied path, allowing path traversal sequences like ../ to escape the intended directory.

Root Cause: In litestar/static_files/base.py, the path resolution logic does not properly validate or normalize the requested path before passing it to the file system. An attacker can craft a URL such as:

/static/../../../etc/passwd

This causes the server to read /etc/passwd instead of a file within the static directory.

Impact: Successful exploitation allows an attacker to read any file on the filesystem that the server process has access to, including:

• Application configuration files (e.g., .env, settings.py)
• Source code
• SSH keys or TLS certificates
• Database credentials

The vulnerability does not allow file modification or code execution directly, but the information disclosure can be leveraged for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.8.3):

# litestar/static_files/base.py (simplified)
async def handle_static_file(self, request: Request) -> Response:
    path = request.path_params["path"]
    full_path = self.directory / path
    if not full_path.exists():
        raise HTTPException(status_code=404)
    return FileResponse(full_path)

The issue: path is not sanitized, allowing ../ sequences.

Patched Code (2.8.3+):

# litestar/static_files/base.py (simplified)
import os
from pathlib import Path

async def handle_static_file(self, request: Request) -> Response:
    path = request.path_params["path"]
    # Normalize and resolve the path to prevent traversal
    full_path = (self.directory / path).resolve()
    if not str(full_path).startswith(str(self.directory.resolve())):
        raise HTTPException(status_code=403)
    if not full_path.exists():
        raise HTTPException(status_code=404)
    return FileResponse(full_path)

The fix uses resolve() to eliminate .. components and then verifies that the resolved path is still within the intended directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a vulnerable Litestar application (version < 2.8.3) with static file serving enabled.
2. Example Docker setup:

   FROM python:3.11-slim
   RUN pip install litestar==2.8.2
   COPY app.py /app/
   WORKDIR /app
   CMD ["python", "app.py"]
   

   app.py:

   from litestar import Litestar, get
   from litestar.static_files import StaticFilesConfig
   
   app = Litestar(
       route_handlers=[],
       static_files_config=StaticFilesConfig(path="/static", directories=["/app/static"]),
   )
   

Exploitation Steps:

1. Identify the static file endpoint (e.g., /static/).
2. Craft a path traversal payload:

   GET /static/../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If successful, the server returns the contents of /etc/passwd.
4. For Windows targets, use backslashes or URL-encoded sequences:

   GET /static/../../../windows/win.ini HTTP/1.1
   

No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e%2f).
• Deploy WAF rules to block requests containing ../ in URL paths.
• Use file integrity monitoring to detect unauthorized reads of sensitive files.

Defense:

• Immediately upgrade to Litestar 2.8.3, 2.7.2, or 2.6.4.
• If patching is not possible, disable static file serving or restrict it to a dedicated, isolated directory.
• Implement strict input validation and path normalization on all file-serving endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ or URL-encoded variants (%2e%2e%2f, ..%252f) in the static file path.
  • Repeated 404 or 403 errors followed by successful 200 responses for sensitive files (e.g., /etc/passwd, /proc/self/environ).
• File System IOCs:
  • Unexpected access to files outside the static directory (e.g., /etc/shadow, .env).
  • Log entries showing file reads from unusual paths.
• Log IOCs:
  • Web server logs with paths like /static/../../../etc/passwd.
  • Application logs showing FileNotFoundError or PermissionError for paths outside the static directory.

Detection Engineering

YARA Rule

rule CVE_2024_32982_Litestar_LFI {
    meta:
        description = "Detects path traversal attempts targeting Litestar static file serving"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32982"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $traversal5 = "..%252f"
    condition:
        any of ($traversal*) and
        # of filesize < 10KB
}

Sigma Rule

title: Litestar LFI Attempt (CVE-2024-32982)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal patterns in HTTP requests to Litestar static file endpoints
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/static/'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
            - '..%252f'
    condition: selection
falsepositives:
    - Legitimate use of '..' in file names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32982 Litestar LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/static/"; http_uri; content:"../"; http_uri; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Litestar to version 2.8.3, 2.7.2, or 2.6.4 (depending on your release branch).
2. Workaround: If patching is delayed, disable static file serving or restrict it to a dedicated directory with no sensitive files.
3. WAF Rules: Deploy web application firewall rules to block path traversal patterns.

Long-Term Measures:

• Implement input validation and path normalization for all file-serving endpoints.
• Use a dedicated, isolated directory for static files with minimal permissions.
• Regularly audit dependencies for known vulnerabilities using tools like pip-audit or Snyk.
• Enable logging and monitoring for file access anomalies.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.