CVE-2025-67487
📋 TL;DR
This vulnerability in Static Web Server (SWS) allows attackers who can create files in the web root directory to create symbolic links that escape the web root, potentially accessing sensitive files elsewhere on the server. It affects all SWS versions 2.40.0 and below. The vulnerability requires an attacker to have write access to the web directory.
💻 Affected Systems
- Static Web Server (SWS)
📦 What is this software?
Static Web Server by Static Web Server
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via access to sensitive system files like /etc/passwd, SSH keys, or configuration files containing credentials.
Likely Case
Unauthorized reading of sensitive files outside web root, potentially exposing configuration files, logs, or application data.
If Mitigated
Limited impact if proper file permissions prevent unauthorized file creation in web root.
🎯 Exploit Status
Exploitation requires write access to web directory first, which may require another vulnerability or misconfiguration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.40.1
Vendor Advisory: https://github.com/static-web-server/static-web-server/security/advisories/GHSA-459f-x8vq-xjjm
Restart Required: Yes
Instructions:
1. Stop SWS service. 2. Update to version 2.40.1 via package manager or manual download. 3. Restart SWS service. 4. Verify version with 'static-web-server --version'.
🔧 Temporary Workarounds
Restrict web directory permissions
linuxPrevent unauthorized file creation in web root directory.
chmod 755 /path/to/webroot
chown root:root /path/to/webroot
Disable directory listing
allPrevent symlink discovery via directory listing.
Edit SWS config to set 'directory-listing' to false
🧯 If You Can't Patch
- Implement strict file permissions on web root directory (read-only for web user).
- Monitor web directory for symlink creation and alert on suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check SWS version; if ≤2.40.0, vulnerable. Test by creating a symlink in web root and attempting to access it via browser.Check Version:
static-web-server --versionVerify Fix Applied:
After patching, attempt to access files outside web root via symlinks - should return 403 or 404 errors.📡 Detection & Monitoring
Log Indicators:
- 403 errors for symlink access attempts after patch
- File creation events in web root directory
Network Indicators:
- HTTP requests attempting to access known sensitive file paths
SIEM Query:
web_access_logs status=403 AND uri CONTAINS '..' OR sensitive_file_names