Executive brief
caolilinode is a simple file server used to host and share files. A security flaw allows an attacker to bypass folder restrictions and access any file on the underlying server's hard drive. This could lead to the theft of sensitive system configuration files, passwords, or private user data.
Technical details
The caolilinode package is vulnerable to a directory traversal (CWE-22) vulnerability because it fails to properly sanitize or resolve relative file paths provided in URLs. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP GET request containing 'dot-dot-slash' (../) sequences. This allows the attacker to escape the application's root directory and read arbitrary files on the host filesystem that the Node.js process has permissions to access. No patch is currently available; users are advised to migrate to a different package for production environments.
Affected products
- caolilinode project caolilinode All versions
Timeline
- 2017-11-01: disclosed: CVE-2017-16159 assigned
- 2018-06-06: advisory: NVD published advisory
- 2020-09-01: advisory: GitHub Advisory Database entry published