Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a ..

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cherokee cherokee httpd0.1
• cherokee cherokee httpd0.1.5
• cherokee cherokee httpd0.1.6
• cherokee cherokee httpd0.2
• cherokee cherokee httpd0.2.5
• cherokee cherokee httpd0.2.6
• cherokee cherokee httpd0.2.7

Other highest-scoring records for the same primary product.

• CVE-2004-1097Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_p
  42Plan
• CVE-2001-1433Cherokee web server before 0.2.7 does not properly drop root privileges after binding to port 80, which could allow remote attackers to gain
  31Monitor
• CVE-2009-3902Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a
  21Monitor
• CVE-2003-1198connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Con
  20Monitor
• CVE-2006-1681Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML vi
  19Monitor
• CVE-2004-2171Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL
  18Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.