Vulnerabilities in pkg:maven/io.vertx/vertx-web

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-45p5-v273-3qqr",
  "modified" : "2026-01-21T16:37:06Z",
  "published" : "2025-10-22T19:38:11Z",
  "aliases" : [ "CVE-2025-11966" ],
  "summary" : "Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names",
  "details" : "# Description\n\n- In the `StaticHandlerImpl#sendDirectoryListing(...)` method under the `text/html` branch, file and directory names are directly embedded into the `href`, `title`, and link text without proper HTML escaping.\n- As a result, in environments where an attacker can control file names, injecting HTML/JavaScript is possible. Simply accessing the directory listing page will trigger an XSS.\n- Affected Code:\n    - File: `vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java`\n    - Lines:\n        - 709–713: `normalizedDir` is constructed without escaping\n        - 714–731: `<li><a ...>` elements insert file names directly into attributes and body without escaping\n        - 744: parent directory name construction\n        - 746–751: `{directory}`, `{parent}`, and `{files}` are inserted into the HTML template without escaping\n\n# Reproduction Steps\n\n1. Prerequisites:\n    - Directory listing is enabled using `StaticHandler`  \n      (e.g., `StaticHandler.create(\"public\").setDirectoryListing(true)`)\n    - The attacker has the ability to create arbitrary file names under a public directory (e.g., via upload functionality or a shared directory)\n\n2. Create a malicious file name (example for Unix-based OS):\n    - Create an empty file in `public/` with one of the following names:\n      - `<img src=x onerror=alert('XSS')>.txt`\n      - Or attribute injection: `evil\" onmouseover=\"alert('XSS')\".txt`\n    - Example:\n      ```bash\n      mkdir -p public\n      printf 'test' > \"public/<img src=x onerror=alert('XSS')>.txt\"\n      ```\n\n3. Start the server (example):\n    - Routing: `router.route(\"/public/*\").handler(StaticHandler.create(\"public\").setDirectoryListing(true));`\n    - Server: `vertx.createHttpServer().requestHandler(router).listen(8890);`\n\n4. Verification request (raw HTTP):\n    ```\n    GET /public/ HTTP/1.1\n    Host: 127.0.0.1:8890\n    Accept: text/html\n    Connection: close\n    ```\n\n5. Example response excerpt:\n    ```html\n    <ul id=\"files\">\n      <li>\n        <a href=\"/public/<img src=x onerror=alert('XSS')>.txt\"\n           title=\"<img src=x onerror=alert('XSS')>.txt\">\n           <img src=x onerror=alert('XSS')>.txt\n        </a>\n      </li>\n      ...\n    </ul>\n    ```\n\n- When accessing `/public/` in a browser, the unescaped file name is interpreted as HTML, and event handlers such as `onerror` are executed.\n\n# Potential Impact\n\n- **Stored XSS**\n    - Arbitrary JavaScript executes in the browser context of users viewing the listing page\n    - Possible consequences:\n        - Theft of session tokens, JWTs, localStorage contents, or CSRF tokens\n        - Unauthorized actions with admin privileges (user creation, permission changes, settings modifications)\n        - Watering hole attacks, including malware distribution or malicious script injection to other pages\n\n- **Common Conditions That Make Exploitation Easier**\n    - Uploaded files are served directly under a publicly accessible directory\n    - Shared/synced directories (e.g., NFS, SMB, WebDAV, or cloud sync) are exposed\n    - ZIP/TAR archives are extracted directly under the webroot and directory listing is enabled in production environments\n\n# Similar CVEs Previously Reported\n\n- CVE‑2024‑32966  \n- CVE‑2019‑15603",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.vertx:vertx-web"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.22"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.vertx:vertx-web"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.0.5"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.0.4"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/vert-x3/vertx-web/security/advisories/GHSA-45p5-v273-3qqr"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-11966"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/vert-x3/vertx-web"
  }, {
    "type" : "WEB",
    "url" : "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-22T19:38:11Z",
    "nvd_published_at" : "2025-10-22T15:15:31Z"
  }
}