CVE-2022-45299 webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL
Attackers can access arbitrary files by supplying a crafted URL to the IpFile argument in the webbrowser-rs library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-45299?
CVE-2022-45299 is a critical path traversal vulnerability in n/a, published on 13 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.
Weakness: CWE-22
Which versions are affected by CVE-2022-45299?
2 open source packages ship an affected version, including webbrowser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
webbrowser crates.io | All versions | 0.8.3 |
webbrowser crates.io | All versions | 0.8.3 |
Products include Webbrowser Project Webbrowser.
How do I fix CVE-2022-45299?
Upgrade webbrowser to 0.8.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-45299 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45299 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2022-45299, GHSA-m589-mv4q-p7rj, UBUNTU-CVE-2022-45299, openSUSE-SU-2024:12620-1.