Executive brief
Algernon, a web server and application server, is vulnerable to a security flaw on Windows systems that allows unauthorized users to view the raw source code of server-side scripts. By appending specific characters to a web request, an attacker can bypass the normal execution of scripts and instead download the file directly. This can lead to the exposure of sensitive information such as database passwords, API keys, and session secrets, which could be used to take over the application or access private data.
Technical details
Algernon fails to properly canonicalize Windows-specific NTFS filename suffixes before determining the file handler. When a request is made for a script (e.g., .lua) with an appended NTFS Alternate Data Stream identifier (::$DATA), a trailing dot, or a trailing space, the `filepath.Ext()` function fails to recognize the file as a script. Consequently, the server bypasses the script execution engine and falls back to a default handler that serves the file as raw bytes. An unauthenticated remote attacker can exploit this to read the source code of any script on a public path, potentially revealing hardcoded credentials or session signing secrets. This vulnerability only affects instances running on Windows with NTFS filesystems.
Affected products
- xyproto algernon <= 1.17.8
Timeline
- 2026-05-29: disclosed
- 2026-07-02: advisory: GitHub Advisory published
- 1.17.9: patched