Host filesystem path disclosure via DNS rebinding
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.9.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Tidewave, a development tool for web applications, is affected by this vulnerability, which can expose the names of the local filesystem paths used by your project, often including the local username and project layout. An attacker who lures a developer to a malicious web page can exploit DNS rebinding to read this information from the locally running Tidewave server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout. This issue affects tidewave: from 0.8.0 before 0.9.2.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- tidewave
From 0.8.0 · fixed in 0.9.2
- tidewave-ai/tidewave_phoenix
Version range not reported
- tidewaveHex
From 0.8.0 · fixed in 0.9.2