Executive brief
Harp is a static site generator used to build and serve web applications. A flaw in its access control allows attackers to bypass protections intended to prevent access to private files and directories (those prefixed with underscore characters) by using URL encoding. This enables unauthorized access to sensitive files that should be hidden from public view.
Technical details
The vulnerability is an improper access control issue (CWE-548) in harp's file serving logic. Harp implements a security feature to ignore and prevent serving files and directories with names starting with underscores (e.g., _secret-folder). However, the access control check fails to normalize URL-encoded input, allowing an attacker to bypass this protection by URL-encoding the underscore character and requesting the file over the network without authentication. By crafting a request with an encoded underscore (%5F), an attacker can retrieve otherwise-protected private files. The vulnerability was fixed in version 0.40.2, which properly handles URL decoding before applying access control checks.
Affected products
- harp harp < 0.40.2
Timeline
- 2019-06-13: disclosed
- 2019-06-13: patched: Fixed in version 0.40.2