Cross-site Scripting (XSS)hfs is a HTTP File Server
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the basicWeb file-listing renderer in src/basicWeb.ts. An attacker can execute script in a victim’s browser by uploading a file with a malicious name and getting someone to open the fallback basic listing, including by forcing /?get=basic in a browser. The listing interpolates file names directly into HTML anchor text without escaping, so the payload is rendered as active markup instead of plain text. On servers that allow uploads to untrusted users, or expose an open upload folder anonymously, this lets the attacker store script in the listing and hijack the browsing session of anyone viewing it.
How to fix Cross-site Scripting (XSS)? Upgrade hfs to version 3.2.1 or higher.
| |
Information Exposurehfs is a HTTP File Server
Affected versions of this package are vulnerable to Information Exposure via differing responses in the loginSrp1 authentication handler in src/api.auth.ts. An attacker can confirm whether an account name exists, including the default admin account, by sending SRP step-1 login requests and comparing the endpoint’s response status and salt behavior for valid versus missing usernames. The login flow returns an immediate unauthorized response for unknown usernames while valid accounts proceed through SRP step 1, creating an observable difference without authentication. This lets a remote unauthenticated attacker probe usernames and then use the confirmed names to support password-guessing and session-forgery attacks.
How to fix Information Exposure? Upgrade hfs to version 3.2.1 or higher.
| |
Cross-site Request Forgery (CSRF)hfs is a HTTP File Server
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the apiMiddleware request filter in src/apiMiddleware.ts. An attacker can create accounts or change configuration by causing a logged-in administrator’s browser to send a state-changing API request with the GET method and no x-hfs-anti-csrf header. The vulnerable middleware treated non-POST requests as CSRF-safe, so browser-triggered GET API calls bypassed the anti-CSRF check and reached administrative handlers such as add_account. In default deployments, the same flaw allows a remote attacker to trigger administrative actions without credentials if the request originates from the server’s own machine.
How to fix Cross-site Request Forgery (CSRF)? Upgrade hfs to version 3.2.1 or higher.
| |
