CVE-2017-16165: Directory Traversal in calmquist.static-server
Summary
CVE-2017-16165: Directory Traversal in calmquist.static-server. Affects calmquist.static-server versions < 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
calmquist.static-server is an npm package used for serving static files in a web server. It allows developers to easily set up a local development environment or serve static files in a production environment. However, versions of calmquist.static-server prior to 0.1.1 are vulnerable to a directory traversal attack. This vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information on the affected system.
Vulnerability Detail
The vulnerability in calmquist.static-server arises from the way it resolves relative file paths. By manipulating the file path in a specific manner, an attacker can traverse directories and access files outside of the intended directory root. For example, an attacker could send a GET request with a crafted file path like GET /../../../etc/passwd to retrieve the contents of the /etc/passwd file. This can result in the exposure of sensitive files containing passwords, user information, or other confidential data. The vulnerability has a severity rating of HIGH according to the Common Vulnerability Scoring System (CVSS) and is classified under CWE-22 (Path Traversal).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk associated with this vulnerability, it is recommended to implement input validation and sanitization on the file paths provided to calmquist.static-server. This can help prevent directory traversal attacks by disallowing any file paths that contain sequences like ../ or ..\ which attempt to navigate outside of the intended directory root.
Conclusion
In conclusion, calmquist.static-server versions prior to 0.1.1 are vulnerable to a directory traversal attack. This can allow an attacker to access sensitive files outside of the intended directory root, potentially leading to the exposure of confidential information. It is recommended to use the package only for local development purposes and switch to a different package for production environments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for calmquist.static-server →
FAQ
calmquist.static-server is an npm package used for serving static files in a web server. It simplifies the process of setting up a local development environment or serving static files in a production environment.
Directory traversal, also known as path traversal, is a vulnerability that allows an attacker to access files or directories outside of the intended directory root. By manipulating file paths, an attacker can navigate to sensitive files and potentially disclose their contents.
The directory traversal vulnerability in calmquist.static-server can lead to the disclosure of sensitive files on the affected system. This can include files containing passwords, user information, or other confidential data.
No, there is no patch available for this vulnerability in calmquist.static-server. It is recommended to use the package only for local development and switch to a different package for production environments.
To mitigate the risk, it is advised to implement input validation and sanitization on the file paths provided to calmquist.static-server. This can help prevent directory traversal attacks by disallowing any file paths that attempt to navigate outside of the intended directory root.
