CVE-2018-3787 simplehttpserver allows directory traversal and file listing

Q: Which versions are affected by CVE-2018-3787?

2 open source packages ship an affected version, including simplehttpserver. It affects 1 product.

Q: Is CVE-2018-3787 being exploited?

There is no known exploitation of CVE-2018-3787 in the wild and no public exploit code.

Q: How do I fix CVE-2018-3787?

Upgrade simplehttpserver to 0.2.1 or later.

High 7.5 Published 31 Aug 2018 Updated 16 Sep 2024

An attacker can exploit a path traversal flaw in simplehttpserver to list any file on the server, leading to information disclosure.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-3787?

CVE-2018-3787 is a high-severity path traversal vulnerability in HackerOne simplehttpserver, published on 31 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.

Weakness: CWE-22

Which versions are affected by CVE-2018-3787?

2 open source packages ship an affected version, including simplehttpserver. It affects 1 product.

Package	Affected	Fixed in
`simplehttpserver` npm	All versions	`0.2.1`
`simplehttpserver` npm	All versions	`0.2.1`

Products include Simplehttpserver Project Simplehttpserver.

How do I fix CVE-2018-3787?

Upgrade simplehttpserver to 0.2.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-3787 being exploited?

There is no known exploitation of CVE-2018-3787 in the wild and no public exploit code.

Sources

Also known as GHSA-gpvj-q7fp-jcch.