Junglewise Threat Intelligence

CVE-2018-16478: simplehttpserver path traversal via symlink navigation

CVE-2018-16478 · Severity: low · CVSS 3 · Published 2018-12-06

Technologies: simplehttpserver (npm). Vendors: npm.

Executive brief

simplehttpserver is a lightweight Node.js HTTP server package. The vulnerability allows attackers to access files outside the intended web directory by following symbolic links in URLs, potentially exposing sensitive files on the server. No patch is currently available.

Technical details

The vulnerability is a path traversal (CWE-22) flaw that permits symlink navigation without proper validation. An unauthenticated attacker can craft URLs containing symlinks to traverse the filesystem and access files outside the webroot with read permissions. The attack requires network access to the server and no authentication, but does not allow file modification or code execution. The advisory recommends against production use pending a fix.

Affected products

  • npm simplehttpserver 0.3.0 and earlier

Timeline

  • 2018-12-06: disclosed

References

Related threats