How to fix Improper Assets Management
in Poem
Executive Summary
Improper Assets Management in Poem typically involves exposing the root project directory or sensitive system paths via the StaticFilesEndpoint. This oversight allows attackers to exfiltrate .env files, source code, and build artifacts, turning a simple file server into a full-system disclosure vector.
The Vulnerable Pattern
use poem::{Route, endpoint::StaticFilesEndpoint, Server, listener::TcpListener};#[tokio::main] async fn main() { // VULNERABLE: Serving from the current directory (’.’) exposes .env, Cargo.toml, and source code. let app = Route::new().at(“/static”, StaticFilesEndpoint::new(”.”));
Server::new(TcpListener::bind("127.0.0.1:3000")) .run(app) .await .unwrap();
}
The Secure Implementation
The vulnerability lies in the 'StaticFilesEndpoint' path configuration. When set to '.' or any parent directory containing sensitive metadata, Poem will serve any file requested within that tree. An attacker requesting '/static/.env' would successfully retrieve your secrets. The fix mandates strict directory isolation: create a dedicated 'public' or 'assets' folder that contains no sensitive information and point the endpoint exclusively there. Additionally, ensure your CI/CD pipeline validates that no secrets are moved into the public assets directory during build time.
use poem::{Route, endpoint::StaticFilesEndpoint, Server, listener::TcpListener};#[tokio::main] async fn main() { // SECURE: Point to a dedicated, isolated directory containing only public assets. // Disable directory listing unless explicitly required for the use case. let app = Route::new().at( “/static”, StaticFilesEndpoint::new(”./public”) .show_files_listing() // Optional: only if you want users to browse );
Server::new(TcpListener::bind("127.0.0.1:3000")) .run(app) .await .unwrap();
}
Your Poem API
might be exposed to Improper Assets Management
74% of Poem apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.