CVE-2017-16152: Directory Traversal in static-html-server
Summary
CVE-2017-16152: Directory Traversal in static-html-server. Affects static-html-server versions < 0.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The static-html-server package is an npm package used for serving static HTML files. It allows developers to quickly set up a local development server for testing and previewing HTML files. However, versions of static-html-server prior to 0.1.2 are vulnerable to a directory traversal vulnerability.
Vulnerability Detail
The vulnerability in static-html-server arises from the way it resolves relative file paths. An attacker can exploit this vulnerability to access files outside of the intended directory root, potentially leading to the disclosure of private files on the vulnerable system. An example request that demonstrates the vulnerability is:
GET /../../../etc/passwd HTTP/1.1 host: foo
This request attempts to access the /etc/passwd file, which contains sensitive system information. The package does not provide a patch for this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to follow the recommended fix mentioned above.
Conclusion
The static-html-server package has a directory traversal vulnerability that allows an attacker to access files outside of the intended directory root. It is recommended to only use this package for local development and to switch to a different package for production. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for static-html-server →
FAQ
This vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
No, only versions prior to 0.1.2 are affected by this vulnerability.
No, there is no patch available for this vulnerability.
It is not recommended to use static-html-server in production due to this vulnerability. If the functionality is needed, it is advised to use a different package.
You can find more information about this vulnerability in the GitHub Advisory Database.
