CVE-2017-16155: Directory Traversal in fast-http-cli
Summary
CVE-2017-16155: Directory Traversal in fast-http-cli. Affects fast-http-cli versions < 0.0.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-http-cli is a command line interface for fast-http, a simple web server. It allows users to interact with the web server through the command line. However, fast-http-cli is vulnerable to a directory traversal issue, which can be exploited by an attacker to gain unauthorized access to the filesystem. By placing "../" in the URL, an attacker can navigate to directories outside of the intended scope and potentially view sensitive files.
Vulnerability Detail
The directory traversal vulnerability in fast-http-cli allows an attacker to bypass the intended restrictions and access files on the filesystem that they should not have access to. This can lead to the exposure of sensitive information, such as configuration files or user credentials. The vulnerability is triggered by including "../" in the URL, which allows the attacker to navigate to parent directories. This issue poses a high risk to the security and integrity of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the best workaround is to avoid using fast-http-cli in production environments. Instead, consider using an alternative package that does not have the directory traversal vulnerability. This will help mitigate the risk of unauthorized access to the filesystem.
Conclusion
The directory traversal vulnerability in fast-http-cli poses a high risk to the security and integrity of the affected system. It is recommended to avoid using fast-http-cli in production environments and to use an alternative package that does not have this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fast-http-cli →
FAQ
fast-http-cli is a command line interface for fast-http, a simple web server. It allows users to interact with the web server through the command line.
The directory traversal vulnerability in fast-http-cli is triggered by including "../" in the URL. This allows an attacker to navigate to parent directories and access files on the filesystem that they should not have access to.
The directory traversal vulnerability in fast-http-cli can lead to the exposure of sensitive information, such as configuration files or user credentials. This can have serious consequences for the security and integrity of the affected system.
No, there is no patch available for this vulnerability in fast-http-cli.
If the functionality provided by fast-http-cli is required for production environments, it is recommended to use a different package that does not have the directory traversal vulnerability.
