7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
C++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File Read
C++ HTTP Server is an HTTP/1.1 server built to handle client connections and serve HTTP requests. Versions 1.0 and below are vulnerable to Path Traversal via the RequestHandler::handleRequest method. This flaw allows an unauthenticated, remote attacker to read arbitrary files from the server's filesystem by crafting a malicious HTTP GET request containing ../ sequences. The application fails to sanitize the filename variable derived from the user-controlled URL path, directly concatenating it to the files_directory base path and enabling traversal outside the intended root. No patch was available at the time of publication.
References
Affected products
- ==<= 1.0
Matching in nixpkgs
pkgs.http-server
Simple zero-configuration command-line http server
pkgs.simple-http-server
Simple HTTP server in Rust
pkgs.perlPackages.HTTPServerSimple
Lightweight HTTP server
pkgs.perlPackages.NetAsyncHTTPServer
Serve HTTP with IO::Async
pkgs.perl538Packages.HTTPServerSimple
Lightweight HTTP server
pkgs.perl540Packages.HTTPServerSimple
Lightweight HTTP server
pkgs.perlPackages.HTTPServerSimplePSGI
Perl Web Server Gateway Interface Specification
pkgs.perlPackages.TestHTTPServerSimple
Test::More functions for HTTP::Server::Simple
pkgs.perl538Packages.NetAsyncHTTPServer
Serve HTTP with IO::Async
pkgs.perl540Packages.NetAsyncHTTPServer
Serve HTTP with IO::Async
pkgs.perlPackages.HTTPServerSimpleMason
Simple mason server
pkgs.perlPackages.HTTPServerSimpleAuthen
Authentication plugin for HTTP::Server::Simple
pkgs.haskellPackages.symantic-http-server
symantic-http applied to the derivation of HTTP servers
-
nixos-unstable 0.1.1.20190410
- nixpkgs-unstable 0.1.1.20190410
- nixos-unstable-small 0.1.1.20190410
pkgs.perl538Packages.HTTPServerSimplePSGI
Perl Web Server Gateway Interface Specification
pkgs.perl538Packages.TestHTTPServerSimple
Test::More functions for HTTP::Server::Simple
pkgs.perl540Packages.HTTPServerSimplePSGI
Perl Web Server Gateway Interface Specification
pkgs.perl540Packages.TestHTTPServerSimple
Test::More functions for HTTP::Server::Simple
pkgs.perl538Packages.HTTPServerSimpleMason
Simple mason server
pkgs.perl540Packages.HTTPServerSimpleMason
Simple mason server
pkgs.perl538Packages.HTTPServerSimpleAuthen
Authentication plugin for HTTP::Server::Simple
pkgs.perl540Packages.HTTPServerSimpleAuthen
Authentication plugin for HTTP::Server::Simple
Package maintainers
-
@anoadragon453 Andrew Morgan <andrew@amorgan.xyz>
-
@figsoda figsoda <figsoda@pm.me>
-
@Mephistophiles Maxim Zhukov <mussitantesmortem@gmail.com>