Executive brief
Whistle is an HTTP/HTTPS debugging proxy used by developers to intercept and inspect network traffic. The application contains a path traversal vulnerability in its temporary file download endpoint that allows an unauthenticated remote attacker to read arbitrary files from the server, such as system configuration files and sensitive data, by manipulating a filename parameter in a web request.
Technical details
The vulnerability is a classic path traversal flaw (CWE-22) in the `/cgi-bin/temp/get` endpoint within service.js. The vulnerable code checks if a user-supplied `filename` parameter matches a temporary file pattern (temp/); if it matches, the filename is safely joined to a restricted directory. However, if the pattern does not match, the code fails to block the request and directly passes the user-supplied filename to the `getFile()` function, allowing arbitrary file reads. The attack requires no authentication and is reachable over the network. An attacker can exploit this by sending a request like `GET /cgi-bin/temp/get?filename=/etc/passwd` to read sensitive system files. The vulnerability is fixed in version 2.10.3 through a code review that removed the insecure path concatenation logic.
Affected products
- avwo whistle < 2.10.3
Timeline
- 2026-08-25: disclosed: Advisory published
- 2026-06-14: patched: Fix committed; version 2.10.3 released