Executive brief
min-http-server is a lightweight HTTP server library. The package fails to sanitize filenames, allowing attackers to inject malicious JavaScript that executes in users' browsers when they access files with specially crafted names. This can lead to session hijacking, credential theft, or malware distribution through a compromised server.
Technical details
The vulnerability is a reflected Cross-Site Scripting (XSS) flaw (CWE-79) in min-http-server's filename handling. The server fails to sanitize or encode filenames before rendering them in HTTP responses, allowing an attacker to craft a file with JavaScript code in its name. When a victim's browser accesses this file through the HTTP server, the unsanitized filename is reflected in the response and executed as JavaScript in the victim's browser context. This requires the victim to visit the server and access the malicious file, and affects all versions up to and including 1.0.6. No patch is currently available.
Affected products
- min-http-server min-http-server up to 1.0.6
Timeline
- 2019-07-31: disclosed
- 2019-07-30: advisory: NVD published