CVE-2024-23770: 
NixOS vulnerability analysis and mitigation

darkhttpd through version 1.15 contains a security vulnerability that allows local users to discover authentication credentials when using the --auth parameter. The vulnerability was discovered and disclosed in January 2024, affecting all versions of darkhttpd up to and including version 1.15 (NVD).

The vulnerability stems from the way darkhttpd handles authentication parameters in the command line. When using the --auth option, the credentials are visible to other users on the system through process listing utilities like ps(1). This exposes the authentication credentials in plain text to any local user who can view process arguments (GitHub Commit).

The vulnerability allows local users to discover HTTP basic authentication credentials by simply listing processes and their arguments. This exposure of credentials could lead to unauthorized access to protected resources on the web server (NVD).

The issue has been acknowledged in darkhttpd's documentation, which now explicitly warns users that the --auth option is insecure. The documentation notes that passwords are sent unencrypted over HTTP and are visible to other users on the system through process listings (GitHub Commit).