CyberRota Analysis
AI-GeneratedAn attacker with control over an SSI-enabled file in Mongoose versions prior to 7.22 can exploit directory traversal vulnerabilities in the mg_ssi() function, potentially disclosing sensitive files accessible by the Mongoose process. This could lead to unauthorized access to critical information, making it essential for users of Mongoose, especially those with SSI enabled, to prioritize upgrading to version 7.22 or later. Organizations utilizing Mongoose for embedded web applications should assess their exposure and apply the necessary updates to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.