CVE-2017-16162

Vulnerability

22lixian is a simple file server for npm. Versions up to and including 1.0.0 are vulnerable to a directory traversal issue. An attacker can craft a URL containing ../ sequences to escape the intended root directory and access arbitrary files on the file system. [1][3]

Exploitation

An attacker needs only network access to the server and does not require authentication. By sending an HTTP request with ../ characters in the URL path (for example, GET /../../../etc/passwd), the server will serve the file located outside the expected web root. A proof-of-concept demonstrating the traversal is available. [2]

Impact

Successful exploitation allows an attacker to read any file on the server that the process has access to, leading to information disclosure of sensitive data such as configuration files, system files, or application secrets. The privilege level is that of the running server process. [1][2]

Mitigation

No fix has been released as of the advisory publication date (2018-07-23). The package appears to be unmaintained; users should avoid using 22lixian or migrate to an alternative file server that prevents directory traversal. [1][3]