Executive brief
fast-http-cli is a command-line web server tool used for local development. It contains a directory traversal vulnerability that allows an attacker to read arbitrary files from the filesystem by crafting URLs with "../" sequences, potentially exposing sensitive system files and configuration data.
Technical details
The vulnerability is a classic directory traversal (CWE-22) issue in fast-http-cli's URL path handling. An attacker can include "../" sequences in HTTP request URLs to escape the intended document root and access files outside the web server's configured directory. The vulnerability requires only network access with no authentication; a simple GET request to a URL like /../../../../../../etc/passwd will return the contents of system files. No patch is available for this issue; the vulnerability affects all released versions up to 0.0.8.
Affected products
- npm fast-http-cli 0.0.8 and earlier
Timeline
- 2018-07-23: disclosed
- other: CVE-2017-16155 assigned