T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/serve.py:21
- Finding
- Static File Server Binds to All Network Interfaces## Vulnerability Details **File Location**: `scripts/serve.py`, lines 21–23 **Vulnerability Type**: Unrestricted network binding and unintended directory exposure **Risk Level**: Medium ### Vulnerable Code ```python os.chdir(directory) Handler = http.server.SimpleHTTPRequestHandler with socketserver.TCPServer(("", port), Handler) as httpd: ``` ### Technical Analysis Passing an empty host string to `socketserver.TCPServer` causes the HTTP server to listen on all available network interfaces rather than only the loopback interface. This conflicts with the documented purpose of providing a localhost preview server. The server uses `SimpleHTTPRequestHandler` after changing the working directory to the selected directory. Consequently, it serves the entire directory tree and can generate directory listings. When the supplied path is a file, the server still exposes that file's entire parent directory rather than restricting access to the requested file. ### Attack Path 1. A user invokes the script with an HTML file or project directory. 2. The selected directory contains sibling files or subdirectories that were not intended for sharing. 3. The server binds to all interfaces through `TCPServer(("", port), Handler)`. 4. A host with network access to the machine connects to the selected port. 5. The remote host requests the directory root or guesses/enumerates file paths. 6. `SimpleHTTPRequestHandler` returns accessible files or directory listings from the served tree. Exploitation requires network reachability to the listening port while the server is running. ### Impact Assessment A reachable attacker may browse or download files under the served directory, including unintended sibling files and nested content. This can cause confidentiality loss within that directory tree. The flaw does not itself grant code execution, privilege escalation, persistence, or access beyond files readable by the account running the ...[truncated 8 chars]
- Remediation
- ## Remediation Suggestions 1. Bind explicitly to the loopback interface: ```python with socketserver.TCPServer(("127.0.0.1", port), Handler) as httpd: ``` 2. If IPv6 localhost support is required, provide an explicit and carefully tested loopback-only configuration rather than a wildcard bind. 3. Restrict requests to the specifically selected file when a file path is supplied, instead of serving its entire parent directory. 4. Disable directory listings by subclassing `SimpleHTTPRequestHandler` and rejecting directory-listing requests. 5. If public network access is a legitimate optional feature, require an explicit flag such as `--bind`, default it to `127.0.0.1`, and display a clear warning when a non-loopback address is selected. 6. Document that all readable content beneath a served directory may otherwise be exposed, and recommend serving a dedicated directory containing only intended public files.