Is CVE-2017-16224 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-16224 being exploited in the wild.

How severe is CVE-2017-16224?

Low severity, with a CVSS score of 3, published 6 August 2018.

Is there a fix for CVE-2017-16224?

A patch was published on 2018-08-06: Version 1.2.2 or later fixes the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-16224 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-16224?

Check whether you run st (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-16224: npm st open redirect vulnerability

CVE-2017-16224 · Severity: low · CVSS 3 · Published 2018-08-06

st is a Node.js module for serving static files over HTTP. An attacker can craft a specially formatted request to trick the module into redirecting users to an arbitrary external domain, potentially enabling phishing attacks or credential theft. This only affects servers hosting st from the root path (/) rather than a subdirectory, and requires user interaction (following the malicious link).

Vendors: npm.

Quick answers

Is CVE-2017-16224 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-16224 being exploited in the wild.
How severe is CVE-2017-16224?: Low severity, with a CVSS score of 3, published 6 August 2018.
Which products and versions are affected?: st (npm) <= 1.2.1.
Is there a fix for CVE-2017-16224?: A patch was published on 2018-08-06: Version 1.2.2 or later fixes the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-16224 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-16224?: Check whether you run st (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

st is vulnerable to an open redirect (CWE-601) allowing an attacker to craft HTTP requests with URL-encoded path traversal sequences (e.g., "//attacker.com/%2e%2e") that bypass path validation. When st serves from the root (/) rather than a subdirectory like (/static/), the vulnerable code returns a 301 redirect to the attacker-controlled domain. The attack requires user interaction (clicking a malicious link) and works only when URL-encoded parent directory references ("..") are present in the request path. The vulnerability is fixed in version 1.2.2 and later.

Affected products

npm st <= 1.2.1

Identifiers

CVE-2017-16224
GHSA-72fg-jqhx-c68p

Timeline

2017-10-13: disclosed: Vulnerability demonstrated in proof-of-concept
2018-08-06: advisory: GitHub Advisory published
2018-08-06: patched: Version 1.2.2 or later fixes the vulnerability

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.