CVE-2017-16134: Directory Traversal in http_static_simple
Summary
CVE-2017-16134: Directory Traversal in http_static_simple. Affects http_static_simple versions < 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The http_static_simple package is an npm package used for serving static files over HTTP. It allows developers to easily serve files from a specified directory. However, versions of http_static_simple prior to 0.1.1 are vulnerable to a directory traversal attack. This vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
Vulnerability Detail
The vulnerability in http_static_simple arises from the way it resolves relative file paths. By manipulating the file path in a specific way, an attacker can traverse directories and access files outside of the intended directory root. This can result in the exposure of private files on the vulnerable system. An example request that exploits this vulnerability is:
GET /../../../etc/passwd HTTP/1.1 host: foo
This request attempts to access the /etc/passwd file, which contains sensitive system information.
The impact of this vulnerability can be significant, as it allows an attacker to access files that should not be publicly accessible. This can lead to the exposure of sensitive data, such as configuration files, user credentials, or other confidential information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, a possible workaround is to implement additional security measures to mitigate the risk of directory traversal attacks. This can include input validation and sanitization to ensure that file paths are restricted to the intended directory root. Additionally, access controls and permissions should be properly configured to limit the exposure of sensitive files.
Conclusion
The http_static_simple package is vulnerable to a directory traversal attack, which can result in the exposure of sensitive files. Unfortunately, there is no patch available for this vulnerability. It is recommended to use alternative packages or implement additional security measures to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for http_static_simple →
FAQ
Directory traversal, also known as path traversal, is a vulnerability that allows an attacker to access files or directories outside of the intended directory root. It occurs when user input is not properly validated or sanitized, allowing malicious actors to manipulate file paths and traverse directories.
A successful directory traversal attack can lead to the exposure of sensitive information, such as configuration files, user credentials, or other confidential data. This can result in unauthorized access, data breaches, or other security incidents.
No, there is no patch available for this vulnerability in the http_static_simple package. It is recommended to use alternative packages or implement additional security measures to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can send a specially crafted HTTP request to the vulnerable server, attempting to access files outside of the intended directory root.
No, only versions prior to 0.1.1 of http_static_simple are affected by this vulnerability. It is recommended to update to the latest version or consider using alternative packages.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
