GHSA-8v2v-wjwg-vx6r actix-files has a possible exposure of information vulnerability

• crates.io actix-files: < 0.6.10 → fixed in 0.6.10

Summary When passing a non-existing folder to the `actix_files::Files::new()` method causes the actix server to expose unexpected files. Details The `actix-files` library exposes a `Files` struct that configures an actix `service` to serve the files in a folder as static assets. Below you can find the signature of the `Files::new` method: ```rust pub fn new>(mount_path: &str, serve_from: T) -> Files ``` When the `mount_path` you pass to `Files` doesn't exist, it defaults to an empty path (`Path::new()`). When the service receives a HTTP request, it joins the request information with the empty path and calls `canonicalize`. Rust resolves this path as relative and returns any file that matches it. This behavior causes the library to expose unexpected files when the folder is not present. PoC _There is a working PoC on https://github.com/Angelmmiguel/actix-files-vuln, although the next steps can be followed to reproduce the issue_ 1. Clone the https://github.com/actix/examples repository. 2. Change your directory to the `basics/static-files` folder. 3. Edit the `src/main.rs` file and change the line 13 to mount a non-existing folder: ```diff • .service(Files::new("/images", "static/images/").show_files_listing()) + .service(Files::new("/images", "static/missing/").show_files_listing()) ``` 4. Run the project with `cargo run`. 5. Access the URL. Impact This is an exposure of information vulnerability. It affects anyone using the `actix-files::Files` library that mounts a non-existing folder for any reason.