Executive brief
http_static_simple is a simple HTTP server used to serve static files. A security flaw allows an attacker to bypass directory restrictions and access any file on the host system that the server has permission to read. This could lead to the exposure of sensitive system files, configuration data, or private user information.
Technical details
The http_static_simple package fails to properly sanitize or validate file paths provided in HTTP requests. By using dot-dot-slash (../) sequences in the URL, a remote, unauthenticated attacker can escape the intended web root directory. This allows for the retrieval of sensitive files (e.g., /etc/passwd) from the underlying filesystem. The vulnerability exists in all versions up to and including 0.1.1, and no official patch has been released. Security researchers recommend migrating to a different package for production environments.
Affected products
- http_static_simple_project http_static_simple <= 0.1.1
Timeline
- 2017-11-02: disclosed: CVE-2017-16134 assigned
- 2018-06-06: advisory: NVD published advisory
- 2018-07-23: advisory: GitHub Advisory published