Sensitive information disclosure

[goecho]

Readable to /etc/passwd file
http://your-ip/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd

[goecho]

Proposes to prevent access to non-web directories

[TheWaWaR]

I think you shouldn't run simple-http-server in /etc

[goecho]

I think it doesn't matter where it runs, it's a security hole.

[TheWaWaR]

The permission of /etc/passwd is -rw-r--r-- means whatever a normal user can read the file, why simple-http-server run by current user can't read the file?

[goecho]

The behavior of using other web-servers is different from it

[TheWaWaR]

But nginx can do that, https://serverfault.com/questions/588770/why-can-nginx-access-etc-pass

[alecdwm]

I think simple-http-server is breaking user expectations by serving files above the current working directory.

For python's http.server, http://localhost:8000/..%2f will map to $(cwd)/.
Whereas for simple-http-server, http://localhost:8000/..%2f will map to $(cwd)/../.

A user who is not aware of this will be accidentally exposing their system to the network, particularly when they have the --upload flag enabled.

[Kinrany]

I also expected simple-http-server to only serve the current working directory. Is that really not the case?

[Avi-D-coder]

Serving files above the path the server was invoked in/with is a major security issue. @TheWaWaR This issue should be reopened. I will fix it today. Additionally after It's fixed all previous versions should be marked with a security notice.

[TheWaWaR]

Sorry, it's definitely a serious problem.

[Avi-D-coder]

Fixed in #35

[Avi-D-coder]

I could use a windows tester for #35 (comment)

[Kinrany]

Thanks :D