Cymmetria / Cymmetria/honeycomb_plugins

simple_http crashes when given URL-encoding in URL

Open
#43 0 comments 0 reactions 0 assignees View on GitHub
bug good first issue
Dominant language
HTML
Stars
27
Forks
15
PR merge metrics
No merged PRs in 30d

Description

If you try to run simple_http on port 8080 and visit "127.0.0.1:8080/fap=432%424" it's going to crash. This is due to the overridden log_message which thinks the "%424" needs to turn into arguments in the "message % args" part of the log.

The solution can be to .replace("%", "%%") in log_request(), thus escaping the formatting.
(While I'm not versed in Python attacks, in C/C++ this would be a real vulnerability)

Contributor guide

Open the contributing guide

Research direction

Find the simple_http entry point and inspect its overridden log_message and log_request methods. Reproduce the crash with a URL containing encoded percent characters such as 127.0.0.1:8080/fap=432%424, then verify that the request is logged without formatting errors and the server remains running.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.