CVE-2020-15101: freewvs - Nested Directory Structure Interruption
Summary
CVE-2020-15101: freewvs's nested directory structure can interrupt scan. Affects freewvs versions < 0.1.1. Fixed in 0.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
freewvs is a Python package available on PyPI that is used for web vulnerability scanning. It provides a command-line interface to scan web applications for security vulnerabilities. The package utilizes Python's recursion limit and os.walk() to traverse directories during the scanning process. However, a vulnerability exists in freewvs where a directory structure with more than 1000 nested directories can interrupt the scan. This can be problematic when scanning directories of potentially untrusted users.
Vulnerability Detail
The vulnerability in freewvs arises due to Python's recursion limit and os.walk(). When a directory structure with more than 1000 nested directories is encountered during a scan, it can cause the scan to be interrupted. This can potentially lead to incomplete scanning of web applications and a failure to detect security vulnerabilities. The impact of this vulnerability is considered low. The issue has been fixed in a commit that limits the recursion to 500 directories.
How To Fix
Minimum fixed version
0.1.1
This is the first release that contains the fix.
pip install --upgrade "freewvs==0.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in freewvs allows a directory structure with more than 1000 nested directories to interrupt the scanning process. This can result in incomplete scans and a failure to detect security vulnerabilities. Users are advised to update to version 0.1.1 or later to fix the vulnerability.
See every vulnerability recorded for freewvs →
FAQ
freewvs is a Python package used for web vulnerability scanning.
The impact of this vulnerability is considered low as it can interrupt scans when encountering a directory structure with more than 1000 nested directories.
To fix the vulnerability, update freewvs to version 0.1.1 or later.
No specific workarounds have been mentioned for this vulnerability.
This vulnerability was discovered by Hanno Böck.
References
Related vulnerabilities
Recent vulnerabilities recorded for freewvs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
