11 matches found
WS-2022-0434
When "hyper-staticfile" performs a redirect for a directory request e.g. a request for "/dir" that redirects to "/dir/", the "Location" header value was derived from user input the request path, simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs...
WS-2022-0409
Path resolution in "hyper-staticfile" didn't correctly validate Windows paths meaning paths like "/foo/bar/c:/windows/web/screen/img101.png" would be allowed and respond with the contents of "c:/windows/web/screen/img101.png". Thus users could potentially read files anywhere on the filesystem. Th...
WS-2022-0412
Path resolution in hyper-staticfile didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This on...
GHSA-5WVV-Q5FV-2388 hyper-staticfile's location header incorporates user input, allowing open redirect
When hyper-staticfile performs a redirect for a directory request e.g. a request for /dir that redirects to /dir/, the Location header value was derived from user input the request path, simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed...
hyper-staticfile's location header incorporates user input, allowing open redirect
When hyper-staticfile performs a redirect for a directory request e.g. a request for /dir that redirects to /dir/, the Location header value was derived from user input the request path, simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed...
RUSTSEC-2022-0072 Location header incorporates user input, allowing open redirect
When hyper-staticfile performs a redirect for a directory request e.g. a request for /dir that redirects to /dir/, the Location header value was derived from user input the request path, simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed...
Location header incorporates user input, allowing open redirect
When hyper-staticfile performs a redirect for a directory request e.g. a request for /dir that redirects to /dir/, the Location header value was derived from user input the request path, simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed...
GHSA-7P7C-PVVX-2VX3 hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This on...
hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This on...
RUSTSEC-2022-0069 Improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This onl...
Improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This onl...