CVE-2017-16083: Directory Traversal in node-simple-router
Summary
CVE-2017-16083: Directory Traversal in node-simple-router. Affects node-simple-router versions < 0.10.1. Fixed in 0.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-simple-router is an npm package that provides a simple router for Node.js applications. It allows developers to define routes and handle HTTP requests easily. However, versions of node-simple-router prior to v0.10.1 are vulnerable to a directory traversal attack.
Vulnerability Detail
The vulnerability in node-simple-router arises from the way it resolves relative file paths. By exploiting this vulnerability, an attacker can traverse directories and access files outside of the intended directory root. This can lead to the disclosure of sensitive files on the affected system. An example request that demonstrates the vulnerability is:
GET /../../../etc/passwd HTTP/1.1 host: foo
This request attempts to access the /etc/passwd file by traversing multiple directories. The recommendation is to update to v0.10.1 or later to mitigate this vulnerability.
How To Fix
Minimum fixed version
0.10.1
This is the first release that contains the fix.
npm install node-simple-router@0.10.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the node-simple-router package prior to v0.10.1 is vulnerable to a directory traversal attack. It is crucial to update to the latest version of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-simple-router →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
Versions of node-simple-router up to and including v0.10.0 are affected.
You can check the version of node-simple-router in your project by inspecting the package.json file or by running the 'npm list node-simple-router' command.
No, the recommended solution is to update to node-simple-router v0.10.1 or later.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-5w8q-x7hc-jhp6/GHSA-5w8q-x7hc-jhp6.json
References
Related vulnerabilities
Recent vulnerabilities recorded for node-simple-router.
