# Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Starlette StaticFiles on Windows resolves UNC paths via os.path.realpath, triggering outbound SMB and leaking the service account's NTLMv2 hash to an attacker host.

- Payout: Research
- Severity: high
- Program: Starlette
- Found by: nvn1729
- Disclosed: 2026-06-15
- CVE: CVE-2026-48818
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wqp7-x3pw-xc5r
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-wqp7-x3pw-xc5r
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:python tech:windows technique:source-review vuln:secrets-leak vuln:ssrf

**Target:** StaticFiles static file handler (os.path.realpath path resolution)
**Root cause:** lookup_path() joins the request path onto the served directory then calls os.path.realpath before the commonpath containment check; on Windows a UNC path is absolute so os.path.join discards the base and realpath performs SMB I/O to the remote host, authenticating with NTLM before containment rejects it.
**Steps:**
1. Run a Starlette/FastAPI app on Windows serving files with StaticFiles in default config (follow_symlink=False).
2. Request a path that resolves to a UNC path such as `\\attacker.com\share`.
3. os.path.join discards the served directory because the UNC path is absolute.
4. os.path.realpath resolves the UNC path, opening SMB (port 445) to attacker.com and sending NTLMv2 auth.
5. Containment check then rejects the path and returns 404, but the hash is already leaked.
**How found:** Reporter examined lookup_path()'s use of os.path.realpath before the commonpath containment check and reasoned that on Windows an absolute UNC path bypasses the join base, causing realpath to perform network I/O prior to validation.
**Exploitation:** Attacker hosts an SMB listener, sends a request with a UNC path to the unauthenticated StaticFiles endpoint, captures the service account's NTLMv2 challenge-response, then cracks it offline or relays it to other hosts. Timing of responses also reveals reachable internal SMB hosts.
**Escalation:** Captured NTLMv2 hash can be cracked offline or relayed (NTLM relay) to other internal hosts for lateral movement; timing differences enable internal host discovery.
**Insight:** Path-containment checks that call realpath/abspath before validating are dangerous on Windows: UNC paths are absolute and cause SMB I/O during resolution, so any pre-validation filesystem call on attacker input can leak NTLM. Audit order-of-operations in path resolvers, not just the final check.