Executive brief
shit-server is a lightweight HTTP server package used for local development. The application fails to properly validate file paths, allowing attackers to access arbitrary files outside the intended directory—such as /etc/passwd on Linux systems—potentially exposing sensitive system files and credentials.
Technical details
This is a path traversal vulnerability (CWE-22) in shit-server where the application does not properly canonicalize or sanitize relative file paths containing directory traversal sequences (e.g., "../"). An unauthenticated network attacker can craft HTTP GET requests with path sequences like "GET /../../../../../../etc/passwd" to access files outside the intended root directory. The vulnerability is present in all versions from 0.0.0 onward. No patch has been released; the package maintainers recommend using the tool only for local development and switching to alternative packages for production use.
Affected products
- <unknown> shit-server all versions (0.0.0+)
Timeline
- 2020-09-01: disclosed: Published in GitHub Advisory Database
- 2017: other: CVE-2017-16147 assigned