Executive brief
tiny-http is a lightweight HTTP server library used in Node.js applications. An attacker can exploit a directory traversal vulnerability to read arbitrary files outside the intended server root directory, potentially exposing sensitive files like private keys, configuration files, or system passwords.
Technical details
The vulnerability is a classic directory traversal (CWE-22) in the file path resolution logic of tiny-http. The server fails to properly sanitize or validate relative path traversal sequences (e.g., "../") in HTTP requests, allowing an attacker to navigate outside the intended document root. An unauthenticated attacker on the network can craft a simple GET request with traversal sequences (e.g., GET /../../etc/passwd) to read arbitrary files with the privileges of the server process. No patch is available; the maintainers recommend the package be used only for local development.
Affected products
- tiny-http tiny-http All versions (0.0.0 and later)
Timeline
- 2017: disclosed: CVE-2017-16097 assigned
- 2020-09-01: advisory: GHSA-cch6-5x4h-6qc5 published