Is CVE-2018-3716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-3716 being exploited in the wild.

How severe is CVE-2018-3716?

Low severity, with a CVSS score of 3.1, published 26 July 2018.

Which products and versions are affected?

simplehttpserver (npm) SEMVER:introduced=0,fixed=0.1.0.

Is there a fix for CVE-2018-3716?

Yes. simplehttpserver (npm): upgrade to 0.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-3716 attacked?

It is attacked over the network.

Am I affected by CVE-2018-3716?

Check whether you run simplehttpserver (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-3716: simplehttpserver stored cross-site scripting

CVE-2018-3716 · Severity: low · CVSS 3.1 · Published 2018-07-26

simplehttpserver is a lightweight HTTP server library used for serving files and directories via the web. Attackers can inject malicious JavaScript into directory listings by controlling filenames, which then executes in the browsers of anyone viewing the directory—potentially allowing account takeover, session hijacking, or malware delivery without requiring authentication from viewers.

Technologies: simplehttpserver (npm). Vendors: npm.

Quick answers

Is CVE-2018-3716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-3716 being exploited in the wild.
How severe is CVE-2018-3716?: Low severity, with a CVSS score of 3.1, published 26 July 2018.
Which products and versions are affected?: simplehttpserver (npm) SEMVER:introduced=0,fixed=0.1.0.
Is there a fix for CVE-2018-3716?: Yes. simplehttpserver (npm): upgrade to 0.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-3716 attacked?: It is attacked over the network.
Am I affected by CVE-2018-3716?: Check whether you run simplehttpserver (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

simplehttpserver (npm): upgrade to 0.1.0 or later
```
npm install simplehttpserver@0.1.0
```

Technical details

This is a stored cross-site scripting (XSS) vulnerability in simplehttpserver's directory listing output. The vulnerability exists because the application fails to properly sanitize or encode filenames when rendering them in HTML directory listings (CWE-79). An attacker must be able to create or control the filename of a file served by the application; when a user accesses the directory listing, the malicious filename executes as JavaScript in their browser context. This requires the attacker to have write access to the served directory but does not require authentication from the victim. The vulnerability affects all versions prior to 0.1.0, which introduced a fix.

Affected products

simplehttpserver simplehttpserver prior to 0.1.0

Identifiers

CVE-2018-3716
GHSA-jrhj-2j3q-xf3v

Timeline

2018-06-07: disclosed
2018-07-26: advisory
2018-07-26: patched: fixed in version 0.1.0

References

https://hackerone.com/reports/309648

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.