3 ms·
> For example, with the python SimpleHTTPServer I can simply request http://localhost/../../.ssh/id_rsa http://localhost/../../.ssh/id_rsa Eh! That’s not true
by guessmyname 7y ago
> For example, with the python SimpleHTTPServer I can simply request http://localhost/../../.ssh/id_rsa http://localhost/../../.ssh/id_rsa
Eh! That’s not true. I just tried and both Python 2.7.16 and Python 3.7.6 return a "404 Not Found” when I try to download and existing file that is located one or more levels up from the directory where the HTTP server was started. Here is a screenshot showing both results: https://i.imgur.com/uizp7zV.png https://i.imgur.com/uizp7zV.png
- londons_explore 7y agoMaybe behaviour has changed recently? In a past version someone has demonstrated this attack on me...
- reificator 7y agoWere you perhaps running from your home directory? Did the directory you were serving contain any symbolic links to folders outside of that directory?
- tveita 7y agoAFAICT SimpleHTTPServer has been protected against basic traversal attacks for a very long time. There have been bugs though, like https://bugs.python.org/issue26657 https://bugs.python.org/issue26657