Homepage
About Snyk

statics-server@0.0.7 vulnerabilities

This is another static server

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the statics-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Directory Traversal

statics-server is an allows you to run statics servers.

Affected versions of this package are vulnerable to Directory Traversal. It is possible to read arbitrary files from a server by creating a symbolic link and linking it to a file outside of the server's public directory.

PoC by 0xche

~/$ ln -s /etc/passwd passwdsym
~/$ curl localhost:8080/passwdsym

How to fix Directory Traversal?

There is no fixed version for statics-server.

*
  • M
Directory Traversal

statics-server allows you to run statics servers.

Affected versions of this package are vulnerable to Directory Traversal. Attackers can access server files by using relative paths due to insufficient input sanitisation. Attackers may be able to read critical files including /etc/passwd.

How to fix Directory Traversal?

There is no fixed version for statics-server.

*
  • H
Cross-site Scripting (XSS)

Affected versions of statics-server are vulnerable to Cross-site Scripting (XSS) attacks. It does not implement any HTML escaping when displays directory index in the browser. Variable v is used in <a href> element without escaping, which allows to embed HTML <iframe> tag with src attribute points to another HTML file in the directory. This file can contain malicious JavaScript code.

How to fix Cross-site Scripting (XSS)?

There is no fix version for statics-server.

*
  • H
Cross-site Scripting (XSS)

Affected versions of statics-server are vulnerable to Cross-site Scripting (XSS) attacks. It does not implement any HTML escaping when displays directory index in the browser. Variable v is used in <a href> element without escaping, which allows to embed HTML <iframe> tag with src attribute points to another HTML file in the directory. This file can contain malicious JavaScript code.

How to fix Cross-site Scripting (XSS)?

There is no fix version for statics-server.

*
Go back to all versions of this package