Junglewise Threat Intelligence

CVE-2017-16039: hftp directory traversal

CVE-2017-16039 · Severity: low · CVSS 3 · Published 2018-07-24

Vendors: npm.

Executive brief

hftp is a lightweight file transfer utility used for serving files locally during development. The vulnerability allows attackers to traverse outside the intended directory root via crafted requests, potentially exposing sensitive system files like /etc/passwd. This could lead to disclosure of private files and system information on vulnerable servers.

Technical details

The vulnerability is a path traversal (CWE-22) flaw in hftp that fails to properly sanitize relative file paths in HTTP requests. An attacker can use sequences like "/../" in GET requests to navigate outside the configured directory root and access arbitrary files on the system. The attack requires only network access and no authentication; a simple HTTP GET request with traversal sequences is sufficient. No patch is available; affected versions include 0.0.6 and all prior releases. The advisory recommends hftp be used only for local development, with alternative packages for production environments.

Affected products

  • hftp hftp 0.0.6 and earlier

Timeline

  • 2018-07-24: disclosed
  • other: CVE-2017-16039 assigned

References