ACME mini-httpd < 1.30 - Unauthenticated Arbitrary File Read
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2018-18778. PoCs published by auk0x01, dyeat, cyberharsh. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a simple scanner for CVE-2018-18778, which exploits an arbitrary file read vulnerability in ACME mini_httpd before 1.30. It checks if the target is vulnerable by attempting to read /etc/passwd.
Description
ACME mini_httpd before 1.30 lets remote users read arbitrary files.
Exploits (3)
This is a simple scanner for CVE-2018-18778, which exploits an arbitrary file read vulnerability in ACME mini_httpd before 1.30. It checks if the target is vulnerable by attempting to read /etc/passwd.
The repository contains a Python script that scans for the presence of CVE-2018-18778, a path traversal vulnerability in mini_httpd 1.27 and earlier. It attempts to read '/etc/passwd' via a crafted request and checks for a specific string to confirm vulnerability.
This repository provides a detailed writeup and proof-of-concept for CVE-2018-18778, an arbitrary file read vulnerability in Mini_httpd 1.29. The vulnerability arises from improper handling of empty Host headers, allowing path traversal to read sensitive files like /etc/passwd.
Nuclei Templates (1)
Server: mini_httpd && 200 || cpe:"cpe:2.3:a:acme:mini-httpd" || server: mini_httpd && 200
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N