Listen to this Post
The vulnerability CVE-2025-67487 in Static Web Server (SWS) versions 2.40.0 and below is a path traversal flaw caused by inadequate symlink restriction. SWS fails to properly validate and confine symbolic links within its designated web root directory. When the server processes a request, it resolves the full path of the requested resource. If a symlink exists within the web root that points to a location outside of it, the server follows this link without applying the necessary security checks. An attacker who gains the ability to create or upload a file within the web root can create a malicious symbolic link. This symlink could point to sensitive system files, such as `/etc/passwd` or application configuration files. By then accessing the symlink through a standard HTTP request to the SWS instance, the attacker can read the contents of the targeted file. This exploit can also be performed via the directory listing feature if enabled. The server’s lack of a security boundary allows the symlink to bridge from the intended document root to any other directory the server process has read permissions for. The core failure is that SWS does not canonicalize paths and check if the final resolved path remains under the web root before serving the file. This vulnerability requires that the attacker first obtains write access to the web directory, which could occur through a separate file upload flaw or compromised credentials. The issue is mitigated in version 2.40.1, which implements proper validation to prevent symlinks from escaping the root folder.
Platform: Static Web Server
Version: ≤2.40.0
Vulnerability: Symlink Directory Traversal
Severity: Medium (CVSS 5.5)
date: 2025-12-09
Prediction: Patch released 2025-12-11
What Undercode Say:
Analytics
+++
| Metric | Value/Code |
+++
| Find existing symlinks in webroot | `find /var/www/html -type l` |
| Test for vulnerability via curl | `curl http://target/link_to_passwd` |
| Check installed SWS version | `dpkg -l static-web-server|/etc/passwd
| Python3 code to create a test symlink | `!/usr/bin/env python3` |
<h2 style="color: blue;">| | `import os` |</h2>
<h2 style="color: blue;">| | `os.symlink('/etc/passwd', 'www/symlink')` |</h2>
<h2 style="color: blue;">+++</h2>
<h2 style="color: blue;">How Exploit</h2>
1. Attacker gains ability to write a file to the SWS web root directory.
2. Attacker creates a symbolic link within the web root pointing to a sensitive target file (e.g.,,/proc/self/environ, or../config.json).GET /malicious_symlink`).
3. Attacker accesses the symlink via a web browser or tool like `curl` by requesting its URL from the SWS server (e.g.,
4. SWS resolves the symlink path and serves the content of the sensitive file outside the web root to the attacker.
Protection from this CVE
Upgrade SWS to version 2.40.1 or later.
If upgrade is delayed, disable following symbolic links in server configuration if the feature exists.
Run the SWS process within a chroot jail or container with minimal file system access.
Ensure the SWS process runs with the least necessary privileges (non-root user).
Implement strict controls on file upload functionality to the web root.
Use a Web Application Firewall (WAF) rule to block paths containing `..` or symlink indicators.
Impact
Unauthorized read access to sensitive files on the server file system.
Potential disclosure of passwords, API keys, and system configuration.
If server runs with high privileges, could lead to full system compromise.
Enables attackers to gather information for further exploits.
Violation of data integrity and confidentiality for hosted applications.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
