CVE-2024-32966: static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names

May 1, 2024

If directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like <img src=x onerror=alert(1)>.txt will allow JavaScript code execution in the context of the web server’s domain.

References

github.com/advisories/GHSA-rwfq-v4hq-h7fg
github.com/static-web-server/static-web-server
github.com/static-web-server/static-web-server/releases/tag/v2.30.0
github.com/static-web-server/static-web-server/security/advisories/GHSA-rwfq-v4hq-h7fg
nvd.nist.gov/vuln/detail/CVE-2024-32966

Code Behaviors & Features

Detect and mitigate CVE-2024-32966 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →