CVE-2021-46104
📋 TL;DR
CVE-2021-46104 is a directory traversal vulnerability in webp_server_go that allows attackers to read arbitrary files on the server by manipulating URL paths. This affects organizations using webp_server_go version 0.4.0 to serve web images. The vulnerability enables unauthorized access to sensitive server files.
💻 Affected Systems
- webp_server_go
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files like /etc/passwd, configuration files, or application secrets, potentially leading to full system compromise.
Likely Case
Attackers would read accessible files within the server's filesystem, potentially exposing configuration data, logs, or other sensitive information.
If Mitigated
With proper file permissions and network segmentation, impact would be limited to files accessible by the web server process.
🎯 Exploit Status
Exploitation requires only HTTP requests with directory traversal sequences like '../' in URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.1 and later
Vendor Advisory: https://github.com/webp-sh/webp_server_go/issues/92
Restart Required: Yes
Instructions:
1. Stop webp_server_go service. 2. Update to version 0.4.1 or later using package manager or manual download. 3. Restart the service.
🔧 Temporary Workarounds
Input Validation Filter
allAdd middleware or reverse proxy to filter directory traversal sequences
nginx: location ~ \.\./ { deny all; }
apache: RewriteRule \.\./ - [F]
File Permission Restriction
linuxRun webp_server_go with minimal file system permissions
chroot /var/www/webp
setfacl -m u:webpuser:rx /var/www/webp
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy WAF with directory traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Test with curl: curl -v 'http://server:port/../../etc/passwd' - if returns file contents, vulnerable.Check Version:
webp-server --versionVerify Fix Applied:
Same test should return 403/404 error after patch.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences
- Access to unexpected file paths
Network Indicators:
- HTTP requests with multiple directory traversal patterns
SIEM Query:
source="webp_server" AND (url="*../*" OR url="*..\\*" OR status=200 AND url!="*.webp")