libnginx-mod-http-fancyindex is using outdated version with missing html escaping

[Stian Skjelstad]

This patch has not made it into libnginx-mod-http-fancyindex from upstream yet.

https://github.com/aperezdc/ngx-fancyindex/commit/2e9555e7596f96ede95723169aa7c4f2e1cb42e5

This causes filenames with html-entities to be served as-is to the end-user, possible XSS if filenames are generated by user.

[Thomas Ward (teward)]

We (Debian) are also checking and merging to Kinetic - can you check if this is patched in Debian as well? So I can make sure its patched in Salsa as well as here in Ubuntu.

[Thomas Ward (teward)]

Also if you have a CVE ID for this please add it to the bug.

[Stian Skjelstad (mywave)]

I did not find any CVE reports when searching for "fancyindex", so I assume there is no report on it. I stumbled across this issue on a discussion online when a user complained about a file with &not in the filename didn't appear correctly on a public archive.

[Thomas Ward (teward)]

which Ubuntu releases are affected by this?

[Steve Beattie (sbeattie)]

This was fixed in debian in nginx 1.18.0-7, and thus was incorporated into ubuntu for kinetic in https://launchpad.net/ubuntu/+source/nginx/1.20.2-2ubuntu2.

The module has been incorporated into the nginx source package since at least trusty, so without further investigation, I would assume trusty through jammy are affected.

[Steve Beattie (sbeattie)]

(the fixing commit landed in the fancyindex module version 0.5.2 which was incorporated in 1.18.0-7)