GitHub Advisoryadvisory · crates.io

GHSA-rwfq-v4hq-h7fg static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names

MEDIUM Published 2024-05-01 Modified 2024-05-01 Official page ↗
Aliases
CVE-2024-32966
Ecosystem
crates.io
Packages
static-web-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weaknesses
CWE-79, CWE-80
Reviewed
2024-05-01

Affected packages

• crates.io static-web-server: < 2.30.0 → fixed in 2.30.0

Description

Summary If directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like `.txt` will allow JavaScript code execution in the context of the web server’s domain. Details SWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least `file_name` and `current_path` could contain malicious data however. `file_uri` could also be malicious but the relevant scenarios seem to be all caught by hyper. Impact For any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-32966 Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References