Skip to content

Conversation

@zer0matt
Copy link

A Directory Traversal attack is made possible due to the lack of real control over the URL that is given as input.

Initializing the payload with this code: echo -e "GET /../../../../etc/passwd HTTP/1.0\r\nHost: localhost\r\n\r\n" | nc localhost 4000 gives the following output:

(Gasu16㉿VM)-[~/Tinyhttpd]
└─$ echo -e "GET /../../../../etc/passwd HTTP/1.0\r\nHost: localhost\r\n\r\n" | nc localhost 4000

HTTP/1.0 200 OK
Server: jdbhttpd/0.1.0
Content-Type: text/html

root:x:0:0:root:/root:/usr/bin/zsh
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
...

The patched code should be able to prevent this behavior and protect against path traversal attacks.

@zer0matt zer0matt changed the title Fixed a directory traversal vuln Fix a directory traversal vuln Jul 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant