CVE-2018-18778 - ACME mini_httpd Arbitrary File Read

CVE-2018-18778 is a security vulnerability affecting ACME mini_httpd (a lightweight web server).
The vulnerability allows remote attackers to read arbitrary files on the server.

It was publicly disclosed in October 2018 and impacts versions of mini_httpd prior to 1.30.

---

Vulnerability Type

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CVSS v3.0: 6.5 (Medium)
• Attack Vector: Network
• Privileges Required: Low
• User Interaction: None

---

Affected Software

• Product: ACME mini_httpd
• Affected versions: All versions before 1.30
• Fixed version: 1.30 and later

---

Description

The vulnerability exists due to improper handling of HTTP requests, specifically related to how the server processes empty or malformed Host headers.

When a specially crafted request is processed, the server may incorrectly construct file paths, which can result in path traversal-style behavior and allow an attacker to access sensitive files outside the intended web directory.

This can expose files such as:

• /etc/passwd
• configuration files
• application source files
• system data depending on permissions

---

Impact

Successful exploitation allows a remote unauthenticated attacker to:

• Read arbitrary files on the affected system
• Access sensitive configuration data
• Potentially gather information for further attacks (reconnaissance)

There is no direct code execution, but information disclosure can be severe in exposed environments.

---

Technical Summary

• Issue occurs in request handling logic when parsing HTTP headers
• Improper validation of the Host header contributes to incorrect file path resolution
• Attacker can manipulate request structure to access unintended filesystem paths

---

Mitigation

• Upgrade mini_httpd to version 1.30 or later
• Restrict direct exposure of the service to untrusted networks
• Use firewall rules to limit access to trusted IP ranges
• Run service with least-privilege user permissions

---

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-18778
• Vendor: http://www.acme.com/software/mini_httpd/
• Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2018-18778
• Snyk Advisory: https://security.snyk.io/vuln/SNYK-UNMANAGED-MINIHTTPD-2374387

---

Disclaimer

This information is provided for educational and defensive security research purposes only.
Do not test or exploit systems without explicit authorization.