CVE-2021-36701
📋 TL;DR
CVE-2021-36701 is an arbitrary file deletion vulnerability in htmly version 2.8.1 that allows remote attackers to delete known files on the host system. This affects all users running the vulnerable version of htmly, particularly those with internet-facing installations.
💻 Affected Systems
- htmly
📦 What is this software?
Htmly by Htmly
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to OS corruption, data loss, or service disruption.
Likely Case
Deletion of web application files, configuration files, or user data causing service outages and data loss.
If Mitigated
Limited impact if proper file permissions and access controls prevent deletion of critical files.
🎯 Exploit Status
The vulnerability is in the backup file deletion functionality and requires knowledge of file paths to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.2 or later
Vendor Advisory: https://github.com/danpros/htmly/issues/481
Restart Required: Yes
Instructions:
1. Backup your htmly installation and data. 2. Download htmly version 2.8.2 or later from the official repository. 3. Replace the existing installation with the updated version. 4. Restart the htmly service or web server.
🔧 Temporary Workarounds
Disable backup functionality
allTemporarily disable the backup feature that contains the vulnerable code
# Modify htmly configuration to disable backup features
# Check configuration files for backup-related settings
Restrict file permissions
linuxSet strict file permissions to prevent deletion of critical files
chmod 644 /path/to/htmly/files
chown www-data:www-data /path/to/htmly/files
🧯 If You Can't Patch
- Implement strict network access controls to limit access to htmly administration interface
- Deploy web application firewall (WAF) rules to block suspicious file deletion requests
🔍 How to Verify
Check if Vulnerable:
Check the htmly version in the admin panel or by examining the application files. Version 2.8.1 is vulnerable.Check Version:
Check htmly admin panel or examine version.txt in installation directoryVerify Fix Applied:
Verify the version is 2.8.2 or later and test backup deletion functionality with controlled test files.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion requests in web server logs
- Multiple failed file deletion attempts
- Requests to backup deletion endpoints with suspicious parameters
Network Indicators:
- HTTP requests to backup deletion endpoints with file path parameters
- Unusual traffic patterns to htmly administration interface
SIEM Query:
source="web_server" AND (uri="/admin/backup/delete" OR uri CONTAINS "backup") AND (status=200 OR status=500)