Nixpkgs security tracker
6.1 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.
References
-
https://github.com/adonisjs/http-server/security/advisories/GHSA-cwm9-gfhc-46f6 x_refsource_CONFIRM
-
https://github.com/adonisjs/http-server/releases/tag/v8.2.1 x_refsource_MISC
-
https://github.com/adonisjs/http-server/releases/tag/v9.1.0 x_refsource_MISC
Affected products
- ==>= 8.0.0-next.0, < 8.2.1
- ==>= 9.0.0, < 9.1.0
Matching in nixpkgs
pkgs.http-server
Simple zero-configuration command-line http server
pkgs.simple-http-server
Simple HTTP server in Rust
pkgs.perlPackages.HTTPServerSimple
Lightweight HTTP server
pkgs.perl5Packages.HTTPServerSimple
Lightweight HTTP server
pkgs.perlPackages.NetAsyncHTTPServer
Serve HTTP with IO::Async
pkgs.perl5Packages.NetAsyncHTTPServer
Serve HTTP with IO::Async
pkgs.perlPackages.HTTPServerSimplePSGI
Perl Web Server Gateway Interface Specification
pkgs.perlPackages.TestHTTPServerSimple
Test::More functions for HTTP::Server::Simple
pkgs.perl5Packages.HTTPServerSimplePSGI
Perl Web Server Gateway Interface Specification
pkgs.perl5Packages.TestHTTPServerSimple
Test::More functions for HTTP::Server::Simple
pkgs.perlPackages.HTTPServerSimpleMason
Simple mason server
pkgs.perl5Packages.HTTPServerSimpleMason
Simple mason server
pkgs.perlPackages.HTTPServerSimpleAuthen
Authentication plugin for HTTP::Server::Simple
pkgs.haskellPackages.symantic-http-server
symantic-http applied to the derivation of HTTP servers
-
nixos-unstable 0.1.1.20190410
- nixpkgs-unstable 0.1.1.20190410
- nixos-unstable-small 0.1.1.20190410
-
nixos-26.05 0.1.1.20190410
- nixos-26.05-small 0.1.1.20190410
- nixpkgs-26.05-darwin 0.1.1.20190410
pkgs.ocamlPackages.cohttp-server-lwt-unix
Lightweight Cohttp + Lwt based HTTP server
-
nixos-unstable -
- nixos-unstable-small 6.2.1
pkgs.perl5Packages.HTTPServerSimpleAuthen
Authentication plugin for HTTP::Server::Simple
pkgs.ocamlPackages_latest.cohttp-server-lwt-unix
Lightweight Cohttp + Lwt based HTTP server
-
nixos-unstable -
- nixos-unstable-small 6.2.1
Package maintainers
-
@MiniHarinn Harinn <prinn.dev@pm.me>
-
@anoadragon453 Andrew Morgan <andrew@amorgan.xyz>
-
@JarvisCraft Petr Portnov <mrjarviscraft+nix@gmail.com>
-
@Mephistophiles Maxim Zhukov <mussitantesmortem@gmail.com>
-
@vbgl Vincent Laporte <Vincent.Laporte@gmail.com>