CVE-2011-4940: XSS
A flaw was reported [1] in Python's SimpleHTTPServer's listdirectory() function. Due to a missing charset parameter, if a user were to connect to SimpleHTTPServer using IE7, which engages in encoding-sniffing and can be tricked into interpretting the output as UTF7. Because of this, an attacker could hide <script> tags in UTF7-encoded characters which do not get quoted by cgi.encode(), allowing XSS attacks.
This has been corrected upstream in version 2.6.7rc2 [2], 2.5.6c1 [3]. It may be fixed in 2.7 as well, but I was unable to find a commit to match it against.
[1] http://bugs.python.org/issue11442 [2] http://svn.python.org/view/python/branches/release26-maint/Lib/SimpleHTTPServer.py?r1=66717&r2=88831&view=patch [3] http://svn.python.org/view/python/branches/release25-maint/Lib/SimpleHTTPServer.py?r1=53148&r2=88815&view=patch
Other sources
The listdirectory function in Lib/SimpleHTTPServer.py in SimpleHTTPSe ...
— Debian
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4940?
CVE-2011-4940 has been assigned a moderate severity level due to its potential for information disclosure through improper handling of character encoding.
How do I fix CVE-2011-4940?
To remediate CVE-2011-4940, upgrade to the fixed versions of Python that include the charset parameter in the list_directory() function.
Which versions of Python are affected by CVE-2011-4940?
CVE-2011-4940 affects Python versions up to 2.5.6 and versions 2.6.x prior to patches that address this issue.
Can CVE-2011-4940 be exploited remotely?
Yes, CVE-2011-4940 can be exploited remotely if an attacker tricks users into connecting to a vulnerable SimpleHTTPServer.
What is the cause of CVE-2011-4940?
The cause of CVE-2011-4940 is a flaw in the list_directory() function of Python's SimpleHTTPServer due to a missing charset parameter.