Junglewise Threat Intelligence

CVE-2017-16097: tiny-http directory traversal

CVE-2017-16097 · Severity: low · CVSS 3 · Published 2020-09-01

Technologies: Tiny-Http. Vendors: Tiny-Http.

Executive brief

tiny-http is a lightweight HTTP server library used in Node.js applications. An attacker can exploit a directory traversal vulnerability to read arbitrary files outside the intended server root directory, potentially exposing sensitive files like private keys, configuration files, or system passwords.

Technical details

The vulnerability is a classic directory traversal (CWE-22) in the file path resolution logic of tiny-http. The server fails to properly sanitize or validate relative path traversal sequences (e.g., "../") in HTTP requests, allowing an attacker to navigate outside the intended document root. An unauthenticated attacker on the network can craft a simple GET request with traversal sequences (e.g., GET /../../etc/passwd) to read arbitrary files with the privileges of the server process. No patch is available; the maintainers recommend the package be used only for local development.

Affected products

  • tiny-http tiny-http All versions (0.0.0 and later)

Timeline

  • 2017: disclosed: CVE-2017-16097 assigned
  • 2020-09-01: advisory: GHSA-cch6-5x4h-6qc5 published

References

Related threats