Improper Encoding or Escaping of Output Affecting rama-http package, versions <0.3.0-rc.1

rama-http is a modular service framework for the 🦀 Rust language to move and transform your network packets. The reasons behind the creation of rama can be read in the "Why Rama" chapter.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the generate_directory_html path in rama-http/src/service/fs/serve_dir/open_file.rs. An attacker can execute a script in a victim’s browser by creating or influencing a file or directory name that is rendered in DirectoryServeMode::HtmlFileList and then getting a user to open the listing page. The vulnerable HTML builds links, breadcrumb labels, and the page title directly from unescaped file names and URI path components, so metacharacters like <, >, ", and ' are interpreted as markup instead of text. This can let an attacker inject arbitrary HTML or JavaScript into the listing, exposing session data or enabling authenticated actions in the application origin.

• GitHub Commit
• Maintainer's Advisory