T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/share_local_path.sh:12
- Finding
- HTTP file server binds to all network interfaces<![CDATA[ ## Vulnerability Details **File Location**: `scripts/share_local_path.sh`, line 12 **Vulnerability Type**: Unintended network exposure and insufficient access restriction **Risk Level**: Medium ### Vulnerable Code ```bash python3 -m http.server "$PORT" >/tmp/trycloudflare-file-server.log 2>&1 & ``` ### Technical Analysis Python's `http.server` binds to all available network interfaces by default when no `--bind` argument is supplied. Although the Cloudflare tunnel connects to `127.0.0.1`, the origin server is also directly accessible through the host's other network interfaces. The server exposes the entire directory selected through `SERVE_DIR`, including directory listings and every readable file below that directory. Its network exposure is therefore broader than the intended localhost-to-tunnel communication path and broader than the single `REL_PATH` printed by the script. ### Attack Path 1. A user runs the script with a directory containing the intended shared file and other readable files. 2. The Python HTTP server listens on `0.0.0.0` or the equivalent wildcard address at the selected port. 3. An attacker on a network capable of reaching the host identifies the open port. 4. The attacker connects directly to `http://HOST:PORT/`, bypassing the public tunnel URL. 5. The attacker uses directory listings or predictable paths to retrieve other files under `SERVE_DIR`. ### Impact Assessment A network-adjacent attacker may obtain unauthorized read access to files beneath the served directory. The process does not grant operating-system privileges beyond those of the invoking user, but it exposes every file that the HTTP server process can read under `SERVE_DIR`. The disclosure scope is particularly significant if the caller selects a home directory, project root, or another directory containing credentials, source code, or private artifacts. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions Bind the origin server explicitly to the loopback interface: ```bash python3 -m http.server --bind 127.0.0.1 "$PORT" ``` Additionally: 1. Create a dedicated temporary export directory with restrictive permissions. 2. Copy only the intended file into that directory. 3. Reject directories as input unless directory-wide sharing is explicitly required. 4. Confirm that the chosen port is listening only on `127.0.0.1`. 5. Consider disabling directory listings or replacing `http.server` with a minimal handler that serves only the requested resource. ]]>