Executive brief
libks is a foundational C library used by SignalWire products to handle HTTP request parsing. A flaw in the URI canonicalization function allows attackers to craft specially-formed HTTP requests with deeply-nested paths that bypass security checks, enabling unauthorized reading of arbitrary files from the server's filesystem. Any SignalWire product or service using libks for HTTP static file serving becomes vulnerable if exposed to untrusted network input.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the clean_uri() function within libks's HTTP request parser (kws.c). The function splits incoming URIs on "/" into a 64-element pointer array for canonicalization, but uses an incorrect buffer size check: it compares the element count against sizeof(argv)—which is the byte size of the pointer array, not the element count—making the rejection logic dead code. When a URI contains more than 64 path segments, ks_separate_string() leaves the unsplit remainder in argv[63]; the canonicalization loop treats this as a literal string and does not process embedded ".." sequences within it. An attacker can submit a GET request with ≥63 padding path segments followed by a traversal payload (e.g., /a/a/.../a/../../../../etc/passwd) to escape the intended document root and read arbitrary files. The attack requires network reachability to a consumer of kws_parse_header() (such as mod_verto's HTTP-static handler in FreeSWITCH) and succeeds whether or not authentication is configured. libks version 2.0.11 and later contain the fix.
Affected products
- signalwire libks < 2.0.11
Timeline
- 2026-06-03: disclosed
- 2026-06-03: patched: Version 2.0.11 released with fix