CVE-2017-16164

Vulnerability

desafio is a simple Node.js-based web server [1]. Versions up to and including 1.1.0 are vulnerable to a directory traversal attack [3]. By placing ../ sequences in the URL, an attacker can read files outside the intended web root, though the server restricts access to files with a .html extension only [1].

Exploitation

An attacker needs only network access to the running desafio server. No authentication or special privileges are required. The attacker crafts an HTTP request containing path traversal patterns (e.g., ../../file.html) in the URL path, which the server processes and serves the corresponding .html file from the filesystem [1][2].

Impact

Successful exploitation allows an attacker to read arbitrary .html files from the server's filesystem, potentially exposing sensitive information such as configuration files, internal documentation, or other HTML-based content that should not be publicly accessible [1].

Mitigation

As of the available references, no patched version of desafio has been released [3]. The advisory notes that the package is no longer maintained [3]. Users should migrate to an alternative web server or remove the package from production environments. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.