Critical File Read Vulnerability in mini-httpd Package
Summary
UBUNTU-CVE-2018-18778: ACME mini_httpd before 1.30 lets remote users read arbitrary files. Affects mini-httpd versions < 1.19-9.3ubuntu0.1~esm1. Fixed in 1.19-9.3ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mini-httpd package is a lightweight HTTP server designed for embedded systems and low-resource environments. It is known for its simplicity and efficiency, making it a popular choice for serving static content. However, the package has been found to have a critical vulnerability that allows unauthorized remote users to read arbitrary files on the server, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2018-18778, affects versions of mini-httpd prior to 1.30. It allows remote attackers to exploit the server's configuration and access files that should be restricted. This can lead to unauthorized disclosure of sensitive data, which could be leveraged for further attacks or data breaches. The vulnerability arises from improper handling of file access permissions, making it crucial for users to address this issue promptly.
How To Fix
Minimum fixed version
1.19-9.3ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mini-httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive files by modifying the server's configuration to deny access to certain directories or files. This can be done by adding the following lines to the mini-httpd configuration file:
deny from all allow from <your_ip_address>
Conclusion
The mini-httpd package has a critical vulnerability (CVE-2018-18778) that allows unauthorized file access. Users are urged to update to the patched versions to mitigate risks. Temporary workarounds can be implemented, but updating is the best long-term solution.
See every vulnerability recorded for mini-httpd →
FAQ
CVE-2018-18778 is a vulnerability in the mini-httpd package that allows remote users to read arbitrary files, potentially exposing sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to sensitive files, which may result in data breaches or further exploitation of the server.
Yes, patched versions of the mini-httpd package are available for Ubuntu Pro users. It is recommended to update to the latest version.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It helps developers ensure their applications are secure.
Related vulnerabilities
Recent vulnerabilities recorded for mini-httpd.
