Marmite
Monthly
Unauthenticated content and configuration tampering in Marmite's optional built-in development server (all versions through 0.4.2) lets any network-reachable attacker create, modify, or overwrite site content and configuration by posting to the /__marmite__/content, /__marmite__/config, and /__marmite__/file/ endpoints, with no credentials or user interaction required. The same handlers pass unsanitized path parameters from handle_create_content and handle_clone_content into filesystem writes, so an attacker can traverse out of the project directory and drop or clobber files elsewhere on the host. Exploitation requires the target to be running `--serve` and reachable over the network - pre-0.4.3 the server bound to 0.0.0.0:8000 by default, and production static sites served by Nginx or Apache are unaffected; no public exploit code was identified at time of analysis, and the vendor released 0.4.3 to fix the issue (loopback-by-default binding plus a documented development-only posture).
Unauthenticated path traversal in Marmite's built-in development server (--serve) lets remote attackers read arbitrary files that the marmite process can access, by submitting percent-encoded '..' sequences that the handle_request function in src/server.rs fails to reject after decoding and path-joining. All versions through 0.4.2 are affected, and exposure is significant because the server previously defaulted to binding 0.0.0.0:8000 (all interfaces) rather than loopback, so any host running --serve on a network-facing address was reachable; the 0.4.3 fix commit narrows the default bind to 127.0.0.1 and labels the server development-only. No public exploit identified at time of analysis and the component is a development-only preview server, but the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H, 8.7) reflects a low-complexity, unauthenticated high-confidentiality read with no integrity or availability impact.
Unauthenticated content and configuration tampering in Marmite's optional built-in development server (all versions through 0.4.2) lets any network-reachable attacker create, modify, or overwrite site content and configuration by posting to the /__marmite__/content, /__marmite__/config, and /__marmite__/file/ endpoints, with no credentials or user interaction required. The same handlers pass unsanitized path parameters from handle_create_content and handle_clone_content into filesystem writes, so an attacker can traverse out of the project directory and drop or clobber files elsewhere on the host. Exploitation requires the target to be running `--serve` and reachable over the network - pre-0.4.3 the server bound to 0.0.0.0:8000 by default, and production static sites served by Nginx or Apache are unaffected; no public exploit code was identified at time of analysis, and the vendor released 0.4.3 to fix the issue (loopback-by-default binding plus a documented development-only posture).
Unauthenticated path traversal in Marmite's built-in development server (--serve) lets remote attackers read arbitrary files that the marmite process can access, by submitting percent-encoded '..' sequences that the handle_request function in src/server.rs fails to reject after decoding and path-joining. All versions through 0.4.2 are affected, and exposure is significant because the server previously defaulted to binding 0.0.0.0:8000 (all interfaces) rather than loopback, so any host running --serve on a network-facing address was reachable; the 0.4.3 fix commit narrows the default bind to 127.0.0.1 and labels the server development-only. No public exploit identified at time of analysis and the component is a development-only preview server, but the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H, 8.7) reflects a low-complexity, unauthenticated high-confidentiality read with no integrity or availability impact.