Thureinoo

An issue exists where an attacker can trigger stored cross-site scripting (XSS) by creating a file with an HTML payload in its name. This occurs when a user browses a directory served with `MG ENABLE DIRLIST`. The `printdirentry()` function, called by `listdir()` in `src/http.c`, URL-encodes the href but inserts the raw filesystem filename into the HTML link text. Consequently, the browser executes the injected markup in the Mongoose origin, potentially exposing session data or allowing actions to be performed as the victim.

An issue exists in the embedded web server and network library where an attacker controlling an SSI-enabled file can use directory traversal sequences within an #include file or #include virtual directive. This occurs because the `mg ssi()` function in src/ssi.c concatenates the directive argument into a filesystem path without utilizing the `mg path is sane()` function. Consequently, deployments using MG ENABLE SSI with a configured ssi pattern may disclose files readable by the Mongoose process.

A remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked headers. The `cl count` and `te count` checks within the `mg http parse()` and `http cb()` functions in src/http.c accept both headers but prioritize chunked encoding. If a reverse proxy prefers Content-Length, a CL.TE desynchronization occurs, allowing the attacker to inject requests that access or modify resources in another user context. CL.TE desynchronization is a type of request smuggling where the front-end and back-end servers disagree on where a request ends.

A remote attacker can insert a lone carriage return or line feed into multipart input processed by the `mg http next multipart()` function in src/http.c. The logic used to compare characters in the loops fails due to an incorrect AND condition, causing the process to stop when any character resembles part of a CRLF (Carriage Return Line Feed) terminator. This results in the truncation of boundaries, filenames, or headers, which may lead an application to accept malicious content by relying on a misleading Content-Type value.

A reflected cross-site scripting issue exists when the `MG ENABLE DIRLIST` feature is enabled. A remote attacker can send a crafted percent-encoded request path to a user, which is then processed by the `mg http serve dir()` and `listdir()` functions in `src/http.c`. These functions place the decoded request URI into the title and h1 HTML elements without proper HTML entity encoding. This allows the execution of malicious scripts in the Mongoose origin, potentially exposing session data or allowing actions to be performed on behalf of the victim.

A remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with `Transfer-Encoding: chunked` and conflicting framing. The `http cb()` function in `src/http.c` contains a logic error where it tests `hm.proto.len` with an impossible greater-than-eight condition, despite `mg http parse()` requiring an eight-byte protocol string. This prevents `is http 1 0` from being set, causing Mongoose to process chunked encoding that an HTTP/1.0 proxy might ignore. This discrepancy enables request smuggling, which can lead to unauthorized access or state changes.