CVE-2024-32966: 
Rust vulnerability analysis and mitigation

Static Web Server (SWS), a fast production-ready web server for static web files and assets, contains a stored Cross-site Scripting (XSS) vulnerability identified as CVE-2024-32966. The vulnerability was discovered and disclosed on April 30, 2024, affecting versions up to and including 2.28.0. The issue exists in the directory listing functionality when untrusted users have upload privileges (GitHub Advisory).

The vulnerability stems from SWS's failure to properly escape HTML entities in directory listing values. Specifically, the file_name and current_path variables can contain malicious data. While file_uri could also potentially be malicious, these scenarios are generally prevented by the hyper framework. The vulnerability has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

When directory listings are enabled in a directory where untrusted users have upload privileges, attackers can create files with malicious names (such as '.txt') that execute JavaScript code in the context of the web server's domain. This results in a stored Cross-site Scripting vulnerability that could potentially affect any web server allowing users to upload files or create directories under names of their choosing (GitHub Advisory).

The vulnerability can be exploited by creating a file with a specially crafted name in a directory where listings are enabled. For example, creating a file named '.txt' in the server's root directory will trigger JavaScript code execution when users access the directory listing page (GitHub Advisory).

Users are advised to upgrade to version 2.30.0 or later which contains the fix for this vulnerability. There are no known workarounds for this vulnerability if you need to maintain directory listing functionality (GitHub Advisory).