Executive brief
hftp is a lightweight file transfer utility used for serving files locally during development. The vulnerability allows attackers to traverse outside the intended directory root via crafted requests, potentially exposing sensitive system files like /etc/passwd. This could lead to disclosure of private files and system information on vulnerable servers.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in hftp that fails to properly sanitize relative file paths in HTTP requests. An attacker can use sequences like "/../" in GET requests to navigate outside the configured directory root and access arbitrary files on the system. The attack requires only network access and no authentication; a simple HTTP GET request with traversal sequences is sufficient. No patch is available; affected versions include 0.0.6 and all prior releases. The advisory recommends hftp be used only for local development, with alternative packages for production environments.
Affected products
- hftp hftp 0.0.6 and earlier
Timeline
- 2018-07-24: disclosed
- other: CVE-2017-16039 assigned