CVE-2023-29159: 
Python vulnerability analysis and mitigation

Starlette versions 0.13.5 and later, prior to 0.27.0, contain a directory traversal vulnerability that allows remote unauthenticated attackers to view files in web services built using Starlette. The vulnerability was discovered by Masashi Yamane of LAC Co., Ltd and reported to JPCERT/CC Vulnerability Coordination Group (JPCERT Advisory, GitHub Advisory).

The vulnerability (CVE-2023-29159) stems from the improper use of os.path.commonprefix() in the StaticFiles component. When a file or directory name starts with the same prefix as the StaticFiles directory, the file becomes exposed due to path traversal. This occurs because os.path.commonprefix() works character by character rather than treating arguments as paths. For example, when accessing '/static/../static1.txt', the function returns './static' as the common part between './static1.txt' and './static', incorrectly allowing access to files outside the intended directory (GitHub Advisory).

The vulnerability breaches confidentiality by allowing attackers to obtain files that should not be publicly accessible. The CVSS v3.1 base score is 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating significant potential for unauthorized file access (NVD).

The vulnerability can be exploited by an unauthenticated remote attacker by sending specially crafted paths to access files outside the intended static files directory. A proof of concept exists demonstrating how files like 'static1.txt' and directories like 'static_disallow' can be exposed through path traversal (GitHub Advisory).

The vulnerability has been fixed in Starlette version 0.27.0 by replacing os.path.commonprefix with os.path.commonpath, which properly handles path comparisons. Users should update to version 0.27.0 or later to address this security issue (GitHub Release).