Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in how starlette.staticfiles.StaticFiles handles file lookups on Windows. The lookup_path function was identified as the vulnerable entry point based on the detailed vulnerability description. The description explicitly states that StaticFiles.lookup_path() calls os.path.realpath on a user-provided path. On Windows, if this path is a UNC path (e.g., \\attacker.com\resource), os.path.realpath attempts to resolve it, causing the system to initiate an SMB connection and leak NTLMv2 credentials.
To confirm this, I analyzed the commits between the last vulnerable version (1.0.1) and the first patched version (1.1.0). The commit fd53168a7767b6b55ba5af787fd88f49e33cabc5 with the message "Reject absolute paths in StaticFiles.lookup_path" directly addresses the issue. The patch adds a check at the beginning of the lookup_path function in starlette/staticfiles.py to explicitly block paths that appear to be absolute, including UNC paths (\\...). This prevents the path from being passed to the vulnerable os.path.realpath call, thus fixing the SSRF vulnerability. The vulnerable function is therefore starlette.staticfiles.StaticFiles.lookup_path.
StaticFiles.lookup_pathstarlette/staticfiles.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| starlette | pip | < 1.1.0 | 1.1.0 |