CVE-2017-16160

Vulnerability

11xiaoli is a simple file server package for Node.js. All versions are vulnerable to a directory traversal issue [1], [2]. By placing the ../ sequence in the URL, an attacker can access files outside the intended serving directory. No specific configuration is required to trigger the vulnerability; the server directly uses user-supplied path segments without sanitization [2].

Exploitation

An attacker needs only network access to the server and can send a crafted HTTP GET request. The exploit path includes sequences such as ../../../etc/passwd to traverse up the directory tree [2]. No authentication or special privileges are required. Public proof-of-concept code exists that demonstrates reading arbitrary files [2].

Impact

Successful exploitation allows an attacker to read arbitrary files from the server's filesystem with the privileges of the Node.js process. This leads to information disclosure of sensitive data, such as configuration files, passwords, or application source code [1], [2].

Mitigation

As of the last available information, no fix or patched version of 11xiaoli has been released [1], [2]. The package is no longer maintained. Users should avoid using this package in production and migrate to an alternative file server that properly sanitizes user input. No workaround is provided in the references.