Is CVE-2014-3744 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-3744 being exploited in the wild.

How severe is CVE-2014-3744?

Low severity, with a CVSS score of 3, published 31 August 2020.

Which products and versions are affected?

st (npm) SEMVER:introduced=0,fixed=0.2.5.

Is there a fix for CVE-2014-3744?

Yes. st (npm): upgrade to 0.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2014-3744 attacked?

It is attacked over the network.

Am I affected by CVE-2014-3744?

Check whether you run st (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-3744: st directory traversal via URL-encoded dots

CVE-2014-3744 · Severity: low · CVSS 3 · Published 2020-08-31

st is a Node.js module for serving static files with caching and HTTP features. Versions before 0.2.5 fail to properly decode URL-encoded dots (%2e), allowing attackers on the network to bypass path restrictions and read sensitive files directly from the server's filesystem.

Vendors: npm.

Quick answers

Is CVE-2014-3744 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-3744 being exploited in the wild.
How severe is CVE-2014-3744?: Low severity, with a CVSS score of 3, published 31 August 2020.
Which products and versions are affected?: st (npm) SEMVER:introduced=0,fixed=0.2.5.
Is there a fix for CVE-2014-3744?: Yes. st (npm): upgrade to 0.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2014-3744 attacked?: It is attacked over the network.
Am I affected by CVE-2014-3744?: Check whether you run st (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

st (npm): upgrade to 0.2.5 or later
```
npm install st@0.2.5
```

Technical details

This is a directory traversal vulnerability (CWE-22) in st's URL path handling. The root cause is improper canonicalization of URL-encoded input: the module fails to decode %2e sequences before validating paths, allowing an attacker to craft requests like /%2e/%2e/etc/passwd that traverse the intended document root. The vulnerability requires only network access and a GET request—no authentication or user interaction is necessary. An unauthenticated remote attacker can read arbitrary files served by the application with the permissions of the st process. The fix is to upgrade to version 0.2.5 or later, which properly normalizes URL-encoded paths before path validation.

Affected products

isaacs st < 0.2.5

Identifiers

CVE-2014-3744
GHSA-69rr-wvh9-6c4q

Timeline

2014-05: disclosed: Disclosed on oss-security mailing list
2014: patched: Fixed in version 0.2.5
2020-08-31: advisory: GitHub Security Advisory published

References

https://github.com/isaacs/st

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.