Plattform
other
Komponente
crystal-live-http-server
CVE-2019-25352 describes a directory traversal vulnerability discovered in Crystal Live HTTP Server. This flaw allows remote attackers to access arbitrary files on the system by manipulating URL path segments, potentially leading to the exposure of sensitive data. The vulnerability affects version 6.01 of the server. Mitigation strategies include restricting access via a Web Application Firewall (WAF) and upgrading to a patched version when available.
The primary impact of this vulnerability is the potential for unauthorized access to sensitive system files. An attacker could leverage the directory traversal flaw by injecting malicious '../' sequences into URL requests. This allows them to navigate outside the intended web root and access files such as configuration files, potentially containing credentials or other sensitive information. Successful exploitation could lead to information disclosure, privilege escalation, and even remote code execution if the accessed files contain executable code. The blast radius extends to any system running the vulnerable version of Crystal Live HTTP Server and accessible via a network.
While no public exploits have been widely reported, the ease of exploitation associated with directory traversal vulnerabilities suggests a potential for active scanning and exploitation. The vulnerability was publicly disclosed on 2026-02-18. It is not currently listed on CISA KEV. The availability of a simple proof-of-concept could increase the likelihood of exploitation.
Systems utilizing Crystal Live HTTP Server version 6.01–6.01, particularly those deployed in environments with limited network segmentation or exposed to the internet, are at significant risk. Shared hosting environments where multiple users share the same server instance are also vulnerable.
disclosure
Exploit-Status
EPSS
0.46% (64% Perzentil)
CISA SSVC
CVSS-Vektor
The recommended mitigation is to upgrade to a patched version of Crystal Live HTTP Server when one becomes available. Until a patch is released, implement temporary workarounds to limit the vulnerability's impact. A Web Application Firewall (WAF) can be configured to block requests containing suspicious '../' sequences. Additionally, restrict access to sensitive directories using file system permissions and access control lists. Regularly review server logs for unusual activity that might indicate an attempted exploitation. After implementing mitigations, verify their effectiveness by attempting to access files outside the web root via URL manipulation.
Actualizar a una versión parcheada del Crystal Live HTTP Server que solucione la vulnerabilidad de path traversal. Si no hay una versión disponible, considerar deshabilitar el servicio o implementar medidas de seguridad adicionales, como restringir el acceso a archivos sensibles y validar las entradas de la URL.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2019-25352 is a vulnerability allowing attackers to access files outside the intended web root in Crystal Live HTTP Server 6.01–6.01 by manipulating URL paths.
If you are running Crystal Live HTTP Server version 6.01–6.01, you are potentially affected by this vulnerability. Upgrade is the recommended solution.
Upgrade to a patched version of Crystal Live HTTP Server. If a patch is unavailable, implement WAF rules and restrict access to the server.
While no widespread exploitation has been confirmed, the ease of exploitation suggests a potential for future attacks. Proactive mitigation is recommended.
Official advisories may be available on the Crystal Live HTTP Server website or through security mailing lists. Check vendor resources for updates.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.