CVE-2017-16187: Directory Traversal in open-device
Summary
CVE-2017-16187: Directory Traversal in open-device. Affects open-device versions < 4.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The open-device package is an npm package used for local development. It provides functionality for resolving relative file paths. However, versions 0 to 4.0.1 of this package are vulnerable to a directory traversal vulnerability. This vulnerability allows a malicious actor to access files outside of the intended directory root, potentially leading to the disclosure of private files on the vulnerable system.
Vulnerability Detail
The directory traversal vulnerability in open-device arises from the package's improper handling of relative file paths. By exploiting this vulnerability, an attacker can craft a request that includes multiple '../' sequences to traverse directories and access files outside of the intended directory root. For example, an attacker could send a GET request to access the '/etc/passwd' file on the vulnerable system. This could result in the disclosure of sensitive information, such as user credentials.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the best workaround is to avoid using the open-device package in production environments. Instead, consider using an alternative package that provides similar functionality but does not have the directory traversal vulnerability.
Conclusion
The open-device package has a directory traversal vulnerability that allows attackers to access files outside of the intended directory root. While no patch is available, it is advised to use this package only for local development. For production environments, it is recommended to switch to a different package that does not have this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for open-device →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
Yes, all versions from 0 to 4.0.1 of open-device are vulnerable to this directory traversal vulnerability.
No, there is no patch available for this vulnerability in the open-device package.
Yes, it is still safe to use open-device for local development purposes. The vulnerability only poses a risk in production environments.
If the functionality provided by open-device is required for production, it is recommended to switch to a different package that does not have the directory traversal vulnerability.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
