Listen to this Post
The vulnerability (CVE-2024-XXXXX) in the Algernon web server (v1.17.4) is a stored Cross-Site Scripting (XSS) flaw arising from improper neutralization of user input in the context of a served file’s name. The server’s MIME type detection and response header generation fail to sanitize filenames containing malicious HTML/JavaScript payloads. When a file with a crafted name (e.g., "><script>alert(1)</script>.txt) is uploaded to or exists within the server’s document root, Algernon includes the unsanitized filename within the HTTP response headers, specifically the `Content-Disposition` or similar fields, during file serving. A victim’s browser receiving this response interprets the filename segment as part of the active document, executing the embedded script in the security context of the Algernon server’s domain. This allows an attacker to steal session cookies, perform actions on behalf of the user, or deface the site, without requiring direct interaction with the vulnerable page beyond triggering the file download or access.
Platform: Algernon Web Server
Version: v1.17.4
Vulnerability: XSS via Filename
Severity: Moderate
Date: 2025-12-10
Prediction: Patch by 2025-12-24
What Undercode Say:
Create a test file with malicious filename touch '"><svg onload=alert(document.domain)>.txt' Simulate a request that triggers the header injection curl -I "http://vulnerable-algernon-server/\"\"><svg onload=alert(document.domain)>.txt"
// Example payload extracted from the filename in the response // Injected into HTTP header: Content-Disposition: attachment; filename=""><svg onload=alert(1)>.txt"
How Exploit:
- Attacker uploads/crafts file with XSS payload in filename.
2. Server stores file without sanitization.
3. Victim requests the malicious file.
4. Server includes payload in HTTP response headers.
5. Victim’s browser renders header content, executing script.
Protection from this CVE:
Update Algernon server.
Sanitize all filenames.
Implement Content-Security-Policy.
Impact:
Session Hijacking
Data Theft
Site Defacement
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
