A route parameter constraint can be bypassed with doubly percent-encoded input, so a handler receives characters that the router was configured to reject.

Impact

A route parameter constraint can be bypassed with doubly percent-encoded input, so a handler receives characters that the router was configured to reject.

Slim (4.0.0-4.15.2) decodes the request path before matching a route, then decodes each captured argument a second time before passing it to the handler. This means that validation will run against a different value than the one the application receives.

Given the route /test/{value:[^/]+}, which forbids a path separator:

Singly-encoded input is not affected. /test/a%2Fb is a 404, since the decode happens before matching and the resulting separator breaks the capture. Only doubly-encoded input reaches a handler in a different form than the router validated.

You are affected if you run Slim 4.0.0 through 4.15.2 and use route placeholder values without revalidating them.

For example consider a file download controller that maps the value to the filesystem:

$app->get('/download/{file:[^/]+}', function ($request, $response, array $args) {
    // The route restricts $file to a single path segment.
    $path = __DIR__ . '/files/' . $args['file'];
    $response->getBody()->write(file_get_contents($path));
    return $response;
});

On affected versions, /download/subdir%252Fsecret.txt would reach the handler as files/subdir/secret.txt, including the subdirectory that was restricted in the route pattern.

Note that this would also defeat filtering applied ahead of the application. A proxy or WAF that decodes once sees the inert %2e%2e%2f while the handler receives ../.

Slim 3.x is not affected.

Patches

Fixed in version 4.15.3. Upgrade with:

composer require slim/slim:^4.15.3

RoutingResults::getRouteArguments() no longer decodes captured values. It never needed to as the path they were captured from already decoded them.

This means that the $urlDecode parameter of getRouteArguments() is now ignored.

Workarounds

If you cannot upgrade, revalidate route placeholder values in the handler and do not rely on the route pattern. Reject any argument containing a path separator before using it.

References

• Slim 4.15.3 release: https://github.com/slimphp/Slim/releases/tag/4.15.3
• URL decoding in routing: https://www.slimframework.com/docs/v4/objects/routing.html#url-decoding
• CWE-174: https://cwe.mitre.org/data/definitions/174.html
• CWE-22: https://cwe.mitre.org/data/definitions/22.html

Credits

Thanks to NomanProdhan and Ilia Alshanetsky for independently reporting this issue.