CVE-2021-40978 Directory traversal in mkdocs
Remote attackers can exploit directory traversal in the MkDocs development server to access sensitive files on the host system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40978?
CVE-2021-40978 is a high-severity path traversal vulnerability in n/a, published on 7 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1
Weakness: CWE-22
Which versions are affected by CVE-2021-40978?
3 open source packages ship an affected version, including mkdocs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mkdocs PyPI | From 1.2.2 | 1.2.3 |
mkdocs PyPI | From 1.2.2 | 1.2.3 |
mkdocs PyPI | From 1.2.2 | 1.2.3 |
Products include Mkdocs Mkdocs.
How do I fix CVE-2021-40978?
Upgrade mkdocs to 1.2.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-40978 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-40978 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2021-40978, GHSA-qh9q-34h6-hcv9, PYSEC-2021-878.