GHSA-pr5m-4w22-8483

NanoHTTPD Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-13697

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.nanohttpd:nanohttpd-nanolets	<= 2.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-13697 advisory
https://github.com/NanoHttpd/nanohttpd package
https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/nanolets/pom.xml web
https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/nanolets/src/main/java/org/nanohttpd/router/RouterNanoH… web
https://www.vdoo.com/advisories/#CVE-2020-13697 web