CVE-2019-25087: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in RamseyK httpserver. It has been rated as critical. This issue affects the function ResourceHost::getResource of the file src/ResourceHost.cpp of the component URI Handler. The manipulation of the argument uri leads to path traversal: '../filedir'. The attack may be initiated remotely. The name of the patch is 1a0de56e4dafff9c2f9c8f6b130a764f7a50df52. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216863.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-12-27T09:15Z
Repository: https://github.com/RamseyK/httpserver
Language: C++
Files changed: README.md, src/HTTPServer.cpp, src/ResourceHost.cpp
Commit date: 2019-09-08 11:23:20 -0500
Commit message: Deny any directory traversal paths.  README update

Diff: diff --git a/README.md b/README.md
index ec0ba22..db89830 100755
--- a/README.md
+++ b/README.md
@@ -1,15 +1,18 @@
 # HTTP Server
 
 Ramsey Kant
 https://github.com/RamseyK/httpserver
 
-A high performance, single threaded, HTTP server written in C++ to serve as a kqueue socket management and HTTP protocol learning tool
+A high performance, single threaded, HTTP server written in C++ to serve as a kqueue socket management and HTTP protocol learning tool on BSD systems
 
 ## Features
 * Clean, documented code
 * Efficient socket management with kqueue
 * Easy to understand HTTP protocol parser (from my ByteBuffer project)
 * Tested on FreeBSD and MacOS
 
+## Compiling Notes
+* On FreeBSD, compile with gmake
+
 ## License
 See LICENSE.TXT
diff --git a/src/HTTPServer.cpp b/src/HTTPServer.cpp
index 75900bc..41fa33d 100755
--- a/src/HTTPServer.cpp
+++ b/src/HTTPServer.cpp
@@ -438,11 +438,11 @@ void HTTPServer::handleRequest(Client *cl, HTTPRequest* req) {
 	}
 
 	std::cout << "[" << cl->getClientIP() << "] " << req->methodIntToStr(req->getMethod()) << " " << req->getRequestUri() << std::endl;
 	/*std::cout << "Headers:" << std::endl;
 	for(int i = 0; i < req->getNumHeaders(); i++) {
-		std::cout << req->getHeaderStr(i) << std::endl;
+		std::cout << "\t" << req->getHeaderStr(i) << std::endl;
 	}
 	std::cout << std::endl;*/
 
 	// Determine the appropriate vhost
 	ResourceHost* resHost = NULL;
diff --git a/src/ResourceHost.cpp b/src/ResourceHost.cpp
index ab65d41..013221c 100755
--- a/src/ResourceHost.cpp
+++ b/src/ResourceHost.cpp
@@ -181,10 +181,13 @@ std::string ResourceHost::generateDirList(std::string path) {
  */
 Resource* ResourceHost::getResource(std::string uri) {
 	if (uri.length() > 255 || uri.empty())
 		return NULL;
 
+	if (uri.find("../") != std::string::npos)
+		return NULL;
+
 	std::string path = baseDiskPath + uri;
 	Resource* res = NULL;
 
 	// Gather info about the resource with stat: determine if it's a directory or file, check if its owned by group/user, modify times
 	struct stat sb;

Vulnerable code: A high performance, single threaded, HTTP server written in C++ to serve as a kqueue socket management and HTTP protocol learning tool
		std::cout << req->getHeaderStr(i) << std::endl;
Fixed code: A high performance, single threaded, HTTP server written in C++ to serve as a kqueue socket management and HTTP protocol learning tool on BSD systems
## Compiling Notes
* On FreeBSD, compile with gmake

		std::cout << "\t" << req->getHeaderStr(i) << std::endl;
	if (uri.find("../") != std::string::npos)
		return NULL;