Executive brief
simplehttpserver is a lightweight HTTP server library used for serving files and directories via the web. Attackers can inject malicious JavaScript into directory listings by controlling filenames, which then executes in the browsers of anyone viewing the directory—potentially allowing account takeover, session hijacking, or malware delivery without requiring authentication from viewers.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in simplehttpserver's directory listing output. The vulnerability exists because the application fails to properly sanitize or encode filenames when rendering them in HTML directory listings (CWE-79). An attacker must be able to create or control the filename of a file served by the application; when a user accesses the directory listing, the malicious filename executes as JavaScript in their browser context. This requires the attacker to have write access to the served directory but does not require authentication from the victim. The vulnerability affects all versions prior to 0.1.0, which introduced a fix.
Affected products
- simplehttpserver simplehttpserver prior to 0.1.0
Timeline
- 2018-06-07: disclosed
- 2018-07-26: advisory
- 2018-07-26: patched: fixed in version 0.1.0