CVE-2014-3744: Directory Traversal in st
Summary
CVE-2014-3744: Directory Traversal in st. Affects st versions < 0.2.5. Fixed in 0.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'st' package is an npm package that provides a simple static file server for Node.js. It allows users to serve static files over HTTP. The package is widely used in web applications to serve static assets such as HTML, CSS, JavaScript, and images. However, versions prior to 0.2.5 of 'st' are vulnerable to a directory traversal attack.
Vulnerability Detail
The vulnerability in 'st' versions prior to 0.2.5 is due to a failure to properly handle URL encoded dots. This allows an attacker to exploit the filesystem interpretation of '%2e' as '.', leading to potential directory traversal. By exploiting this vulnerability, an attacker can read sensitive files on the server. This can result in unauthorized access to confidential information or the execution of arbitrary code.
How To Fix
Minimum fixed version
0.2.5
This is the first release that contains the fix.
npm install st@0.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the 'st' package to the fixed version to mitigate the risk of exploitation.
Conclusion
The 'st' package prior to version 0.2.5 is vulnerable to a directory traversal attack. To mitigate this vulnerability, it is crucial to update the package to version 0.2.5 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for st →
FAQ
The vulnerability allows an attacker to read sensitive files on the server, potentially leading to unauthorized access to confidential information or the execution of arbitrary code.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, updating the 'st' package to version 0.2.5 or later fixes the vulnerability and mitigates the risk of exploitation.
No, there are no known workarounds for this vulnerability. Updating the package is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for st.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.