Is CVE-2017-16097 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-16097 being exploited in the wild.

How severe is CVE-2017-16097?

Low severity, with a CVSS score of 3, published 1 September 2020.

Which products and versions are affected?

Tiny-Http All versions (0.0.0 and later).

Is there a fix for CVE-2017-16097?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2017-16097 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-16097?

Check whether you run Tiny-Http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-16097: tiny-http directory traversal

CVE-2017-16097 · Severity: low · CVSS 3 · Published 2020-09-01

tiny-http is a lightweight HTTP server library used in Node.js applications. An attacker can exploit a directory traversal vulnerability to read arbitrary files outside the intended server root directory, potentially exposing sensitive files like private keys, configuration files, or system passwords.

Technologies: Tiny-Http. Vendors: Tiny-Http.

Quick answers

Is CVE-2017-16097 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-16097 being exploited in the wild.
How severe is CVE-2017-16097?: Low severity, with a CVSS score of 3, published 1 September 2020.
Which products and versions are affected?: Tiny-Http All versions (0.0.0 and later).
Is there a fix for CVE-2017-16097?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2017-16097 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-16097?: Check whether you run Tiny-Http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic directory traversal (CWE-22) in the file path resolution logic of tiny-http. The server fails to properly sanitize or validate relative path traversal sequences (e.g., "../") in HTTP requests, allowing an attacker to navigate outside the intended document root. An unauthenticated attacker on the network can craft a simple GET request with traversal sequences (e.g., GET /../../etc/passwd) to read arbitrary files with the privileges of the server process. No patch is available; the maintainers recommend the package be used only for local development.

Affected products

tiny-http tiny-http All versions (0.0.0 and later)

Identifiers

CVE-2017-16097
GHSA-cch6-5x4h-6qc5

Timeline

2017: disclosed: CVE-2017-16097 assigned
2020-09-01: advisory: GHSA-cch6-5x4h-6qc5 published

References

https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/tiny-http

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.