Directory traversal using specially crafted HTTP headers

[Corbin]

Modern web browsers ignore "../" in the URL, and just send the request without them, making the server seem secure. But sending requests to the server without a web browser allows you to put anything in the headers that you want.

Using python sockets, I was able to get a copy of the host's /etc/passwd file. My header was quite simple:

"GET /../../../../../../../../etc/passwd HTTP/1.1\r\n\n"

And the server simply responded with a "200 OK" header, and the host's /etc/passwd file.

If the daemon is running as root, an attacker will be able to look at virtually any file in the file system. This is a serious problem, and should be addressed before the first release of HTTPy.

[Corbin (corbin)]

The "fix" in revision 8 did not fix it at all. An attacker has to use "....//" instead of "../" and it is vulnerable again. Reopening.

[Corbin (corbin)]

As this blocks release, I have updated its priority to critical.