7.5

CVSS Score

3.0

Basic Information

CVE ID

CVE-2017-16198

GHSA ID

GHSA-gf7h-vg5v-cch6

EPSS Score

0.67306%

CWE

CWE-22

Published

8/6/2018

Updated

9/11/2023

KEV Status

Technology

JavaScript

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2017-16198

CVE-2017-16198: Directory Traversal in ritp

Affected versions of ritp resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:

GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo

Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

(GitHub Advisory)

7.5

CVSS Score

3.0

Basic Information

CVE ID

CVE-2017-16198

GHSA ID

GHSA-gf7h-vg5v-cch6

EPSS Score

0.67306%

CWE

CWE-22

Published

8/6/2018

Updated

9/11/2023

KEV Status

Technology

JavaScript

Technical Details

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ritp	npm	<= 1.0.5

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper path resolution when handling user requests. Static file servers typically have a function that maps URL paths to filesystem paths. The advisory explicitly states the package resolves relative paths insecurely, and the example attack uses path traversal sequences. Without code inspection, we infer the core file-serving function (commonly named serveFile/handleRequest in Node.js servers) fails to properly sanitize input or validate resolved paths against the root directory. This matches CWE-22's pattern of insufficient path limitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* `ritp` r*solv* r*l*tiv* *il* p*t*s, r*sultin* in * *ir**tory tr*v*rs*l vuln*r**ility. * m*li*ious **tor **n us* t*is vuln*r**ility to ****ss *il*s outsi** o* t** int*n*** *ir**tory root, w*i** m*y r*sult in t** *is*losur* o* priv

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* r*solution w**n **n*lin* us*r r*qu*sts. St*ti* *il* s*rv*rs typi**lly **v* * *un*tion t**t m*ps URL p*t*s to *il*syst*m p*t*s. T** **visory *xpli*itly st*t*s t** p**k*** r*solv*s r*l*tiv* p*t*s ins**ur*ly, *

7.5

Basic Information

Concerned about an active attack path?

CVE-2017-16198: Directory Traversal in ritp

Recommendation

7.5

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI