8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-74m3-9qvm-rp9h

GHSA-74m3-9qvm-rp9h: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Summary The zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process.

Attack Vector: Network — exploitation is performed entirely over the WebDAV endpoint; the attacker issues HTTP requests to the public zrok share URL.
Attack Complexity: High — a precondition outside the attacker's direct control must hold: a symlink pointing outside DriveRoot must already exist within it (created locally, not via WebDAV).
Privileges Required: None — zrok share public --backend-mode drive exposes the WebDAV endpoint with no authentication by default.
User Interaction: None — once the symlink precondition is met, exploitation requires no user interaction.
Scope: Changed — the vulnerability allows an attacker to escape the WebDAV root (the security boundary) and access the broader host filesystem.
Confidentiality Impact: High — arbitrary files readable by the zrok process can be retrieved.
Integrity Impact: High — the WebDAV PUT handler opens files with O_RDWR|O_CREATE|O_TRUNC, meaning symlink targets outside DriveRoot can be overwritten (e.g. ~/.ssh/authorized_keys).
Availability Impact: None — no direct availability impact.

Affected Components

drives/davServer/file.go — Dir.OpenFile (line 140), Dir.Stat (line 176), Dir.Mkdir (line 133), Dir.RemoveAll (line 151)
endpoints/drive/backend.go — NewBackend (line 51–52)

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-74m3-9qvm-rp9h

GHSA-74m3-9qvm-rp9h:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openziti/zrok	go	<= 1.1.11
github.com/openziti/zrok/v2	go	< 2.0.2	2.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the WebDAV drive backend of zrok, specifically within the davServer.Dir type's methods for handling file operations. The root cause is the failure to properly handle symbolic links when resolving file paths. The vulnerable functions (OpenFile, Stat, Mkdir, RemoveAll, and Rename) used a lexical path normalization function, d.resolve(name), which did not check for or correctly handle symlinks. This allowed an attacker, who could convince a local user to create a malicious symlink within the WebDAV root directory, to traverse outside of this restricted directory.

When a WebDAV request was made to a path containing such a symlink, the zrok process would follow it, granting access to files and directories on the host filesystem with the same permissions as the zrok process. This could lead to arbitrary file reads, writes, and deletions, resulting in a high impact on confidentiality and integrity.

The patch addresses this vulnerability by introducing a new, more secure path resolution function called resolveBoundedPath. This function carefully resolves paths segment by segment, explicitly checking for symbolic links. If a symlink is found, it ensures that the target of the symlink resolves to a path that is still within the intended WebDAV root directory. If a symlink attempts to break out of this sandbox, the operation is denied with a permission error. All the vulnerable file operation methods were updated to use this new secure path resolution function, effectively closing the path traversal vulnerability.

Vulnerable functions

davServer.Dir.OpenFile

drives/davServer/file.go

The `OpenFile` function was vulnerable to a path traversal attack because it used `d.resolve(name)` to construct a file path. This function did not properly handle symbolic links, allowing a symlink within the WebDAV root to point to a location outside of it. An attacker could then use this symlink to open and read or write arbitrary files on the host system with the permissions of the zrok process. The patch replaces the unsafe `d.resolve` with `d.resolveBoundedPath`, which validates the path and prevents traversal outside the designated root.

davServer.Dir.Stat

drives/davServer/file.go

The `Stat` function was vulnerable to path traversal. It used `d.resolve(name)` which did not account for symbolic links. An attacker could create a symlink pointing outside the WebDAV root and use `Stat` to retrieve information about files and directories on the host filesystem, which could be used to gather information for further attacks. The fix involves using the new `resolveBoundedPath` function to ensure the path is within the allowed directory before calling `os.Stat`.

davServer.Dir.Mkdir

drives/davServer/file.go

The `Mkdir` function was vulnerable as it used `d.resolve(name)` to determine the directory path for creation. If a part of the path was a symlink pointing outside the WebDAV root, this could lead to directory creation outside the intended scope. The patch corrects this by using `resolveBoundedPath` to validate the path before creating the directory.

davServer.Dir.RemoveAll

drives/davServer/file.go

The `RemoveAll` function was vulnerable to path traversal. By using `d.resolve(name)`, it was possible to make the function operate on a symlink pointing to a location outside the WebDAV root. This could allow an attacker to delete arbitrary files and directories on the host filesystem that are accessible to the zrok process. The patch mitigates this by using `resolveBoundedPath` to ensure the path is safe before removal.

davServer.Dir.Rename

drives/davServer/file.go

The `Rename` function was vulnerable to path traversal through symlinks in both the source (`oldName`) and destination (`newName`) paths. It used `d.resolve` which did not handle symlinks, allowing an attacker to move files from or to locations outside the WebDAV root. This could lead to arbitrary file writes or overwrites. The patch fixes this by using `resolveBoundedPath` to validate both paths.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.