CVE-2017-16147: Directory Traversal in shit-server
Summary
CVE-2017-16147: Directory Traversal in shit-server. Affects shit-server versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shit-server package is an npm module used for local development. It provides functionality for serving files and directories over HTTP. However, it is vulnerable to a directory traversal attack, which allows an attacker to access files outside of the intended directory root.
Vulnerability Detail
The vulnerability in shit-server arises from its resolution of relative file paths. By exploiting this vulnerability, a malicious actor can craft a request that includes multiple '../' sequences to traverse directories and access files outside of the intended root directory. This can lead to the disclosure of sensitive files on the vulnerable system. An example request that demonstrates this vulnerability is:
GET /../../../etc/passwd HTTP/1.1
host: foo
This vulnerability has a high severity rating and is classified under CWE-22 (Path Traversal).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as mentioned in the 'how_to_fix' section, the best approach is to avoid using shit-server in production environments.
Conclusion
The shit-server package is vulnerable to a directory traversal attack, which allows an attacker to access files outside of the intended directory root. As there is no patch available, it is recommended to only use this package for local development purposes. If production functionality is required, it is advised to switch to a different package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shit-server →
FAQ
This vulnerability allows an attacker to access sensitive files on the vulnerable system, potentially leading to the disclosure of private information.
No, there is no patch available for this vulnerability in the shit-server package.
It is recommended to only use shit-server for local development purposes and avoid using it in production environments.
This vulnerability has a high severity rating.
This vulnerability is classified under CWE-22 (Path Traversal).
