[原文]Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via malformed HTTP requests such as (1) a GET request without the HTTP version (HTTP/1.1), or (2) a request without GET or the HTTP version.
TinyServer is prone to multiple vulnerabilities.
A directory traversal issue is present in TinyServer that could allow a remote user to view or download any file to which the server has access.
A denial of service issue exists due to the failure of the server to check input strings received. Attackers can crash the server by simply sending malformed HTTP GET requests. Sending an HTTP GET request with excessively long data can also cause the server to fail. It is not known if this issue may also result in code execution.
A cross-site scripting issue is also present in the server. This could allow for theft of cookie-based authentication credentials or other attacks.
GET /aaaaaa[ 260 of a ]aaa HTTP/1.1
TinyServer contains a flaw that may allow a remote denial of service. The issue is triggered when a specially crafted URL that does not contain both GET and HTTP/1.1 tags, and will result in loss of availability for the service.
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.