Stored Cross-Site Scripting

Overview

All versions of simplehttpserver are vulnerable to stored cross-site scripting (XSS). To be exploited an attacker needs to control the filename of a file that is used in the directory listing output.

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not use this module if the exploitable conditions are met.

References

• HackerOne Report
• GitHub Advisory