PT-2021-9673 · Nanohttpd · Nanohttpd

Published 2021-02-23 · Updated 2021-02-26 · CVE-2020-13697

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NanoHTTPD versions through 2.3.1

Description An issue was discovered in RouterNanoHTTPD.java. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.

Recommendations For versions through 2.3.1, consider implementing a custom GET handler to sanitize user input passed through the query string, or restrict access to the GeneralHandler class to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13697

GHSA-PR5M-4W22-8483

Affected Products

Nanohttpd

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2020-13697 · Security Note
• https://osv.dev/vulnerability/GHSA-pr5m-4w22-8483 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13697 · Vendor Advisory
• https://github.com/NanoHttpd/nanohttpd · Note
• https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/nanolets/src/main/java/org/nanohttpd/router/RouterNanoHTTPD.java · Note
• https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/nanolets/pom.xml · Note
• https://t.me/cibsecurity/23978 · Telegram Post
• https://vdoo.com/advisories/#CVE-2020-13697 · Note
• https://vdoo.com/advisories · Note
• https://t.me/cvenotify/10344 · Telegram Post