CVE-2021-46104: An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server.

PriorityP353high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

4.23%

89.8th percentile

An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
webp	webp_server_go	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fetc/passwd↗

path/etc/passwd↗

yara↗

rule CVE_2021_46104_webp_path_traversal { strings: $traversal = /%252e%252e%252f/ condition: $traversal }

→Look for HTTP GET requests containing double URL-encoded path traversal sequences (%252e%252e%252f) targeting the webp_server_go service. ↗
→A successful exploit response will return HTTP 200 and a body matching the regex 'root:.*:0:0', indicating /etc/passwd was read. ↗
→Shodan query 'http.html:"Webp"' can be used to identify exposed webp_server_go instances for proactive scanning. ↗

·The exploit uses double URL encoding (%25 encoding of the percent sign) to bypass path sanitization; single-encoded traversal sequences may not trigger the vulnerability. ↗
·The vulnerability is specific to webp_server_go version 0.4.0; version 0.4.1 and later include proper path sanitization. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.