{"id":"CVE-2017-16224","aliases":["EUVD-2018-0375","GHSA-72fg-jqhx-c68p"],"status":"published","title":"Open Redirect in st","description":"st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. (\"%2e%2e\", \"%2e.\", \".%2e\").","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00866,"percentile":0.58924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2018-06-07T02:00:00Z","modified":"2026-10-24T10:31:05Z","fixes":[{"ecosystem":"npm","package":"st","fixed_in":["1.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"st","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.1"},{"fixed":"1.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"st","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}]}],"products":[{"vendor":"hackerone","product":"st node module"},{"vendor":"st_project","product":"st"}],"references":[{"url":"https://nodesecurity.io/advisories/547","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16224","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-72fg-jqhx-c68p","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/547","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16224","description":"st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. (\"%2e%2e\", \"%2e.\", \".%2e\").","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-16T20:47:48.66Z","cwes":["CWE-601"],"updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2018-0375","description":"st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. (\"%2e%2e\", \"%2e.\", \".%2e\").","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-16T20:47:48Z","updated_at":"2026-11-03T00:55:10.854479Z"}],"ghsa":[{"id":"GHSA-72fg-jqhx-c68p","title":"Open Redirect in st","description":"st is a module for serving static files.\n\nAn attacker is able to craft a request that results in an `HTTP 301` (redirect) to an entirely different domain. \n\nA request for: `http://some.server.com//nodesecurity.org/%2e%2e` would result in a 301 to `//nodesecurity.org/%2e%2e` which most browsers treat as a proper redirect as `//` is translated into the current schema being used.\n\n**Mitigating factor:** \n\nIn order for this to work, `st` must be serving from the root of a server (`/`) rather than the typical sub directory (`/static/`) and the redirect URL will end with some form of URL encoded `..` (\"%2e%2e\", \"%2e.\", \".%2e\"). \n\nCode example (provided by Xin Gao): \n\n[example.js]\n\n```js\nvar st = require('st') \nvar http = require('http') \nhttp.createServer(st(process.cwd())).listen(1337)\n```\n\n```shell\n$ curl -v http://localhost:1337//cve.mitre.com/%2e%2e\n*   Trying ::1...\n* TCP_NODELAY set\n* Connected to localhost (::1) port 1337 (#0)\n\u003e GET //cve.mitre.com/%2e%2e HTTP/1.1\n\u003e Host: localhost:1337\n\u003e User-Agent: curl/7.54.0\n\u003e Accept: */*\n\u003e\n\u003c HTTP/1.1 301 Moved Permanently\n\u003c cache-control: public, max-age=600\n\u003c last-modified: Fri, 13 Oct 2017 22:56:33 GMT\n\u003c etag: \"16777220-46488904-1507935393000\"\n\u003c location: //cve.mitre.com/%2e%2e/\n\u003c Date: Fri, 13 Oct 2017 22:56:41 GMT\n\u003c Connection: keep-alive\n\u003c Content-Length: 30\n\u003c\n* Connection #0 to host localhost left intact\n```\n\n\n## Recommendation\n\nUpdate to version 1.2.2 or later.","status":"published","published":"2018-08-06T21:33:31Z","modified":"2023-09-11T18:37:42Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:37:03.916765Z"}],"nvd":[{"id":"CVE-2017-16224","description":"st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. (\"%2e%2e\", \"%2e.\", \".%2e\").","status":"published","published":"2018-06-07T02:29:07.723Z","modified":"2026-06-17T01:09:00.37Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-16224","description":"st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. (\"%2e%2e\", \"%2e.\", \".%2e\").","status":"published","published":"2018-06-07T02:29:07.723Z","modified":"2026-10-24T10:31:05.279747947Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"GHSA-72fg-jqhx-c68p","title":"Open Redirect in st","description":"st is a module for serving static files.\n\nAn attacker is able to craft a request that results in an `HTTP 301` (redirect) to an entirely different domain. \n\nA request for: `http://some.server.com//nodesecurity.org/%2e%2e` would result in a 301 to `//nodesecurity.org/%2e%2e` which most browsers treat as a proper redirect as `//` is translated into the current schema being used.\n\n**Mitigating factor:** \n\nIn order for this to work, `st` must be serving from the root of a server (`/`) rather than the typical sub directory (`/static/`) and the redirect URL will end with some form of URL encoded `..` (\"%2e%2e\", \"%2e.\", \".%2e\"). \n\nCode example (provided by Xin Gao): \n\n[example.js]\n\n```js\nvar st = require('st') \nvar http = require('http') \nhttp.createServer(st(process.cwd())).listen(1337)\n```\n\n```shell\n$ curl -v http://localhost:1337//cve.mitre.com/%2e%2e\n*   Trying ::1...\n* TCP_NODELAY set\n* Connected to localhost (::1) port 1337 (#0)\n\u003e GET //cve.mitre.com/%2e%2e HTTP/1.1\n\u003e Host: localhost:1337\n\u003e User-Agent: curl/7.54.0\n\u003e Accept: */*\n\u003e\n\u003c HTTP/1.1 301 Moved Permanently\n\u003c cache-control: public, max-age=600\n\u003c last-modified: Fri, 13 Oct 2017 22:56:33 GMT\n\u003c etag: \"16777220-46488904-1507935393000\"\n\u003c location: //cve.mitre.com/%2e%2e/\n\u003c Date: Fri, 13 Oct 2017 22:56:41 GMT\n\u003c Connection: keep-alive\n\u003c Content-Length: 30\n\u003c\n* Connection #0 to host localhost left intact\n```\n\n\n## Recommendation\n\nUpdate to version 1.2.2 or later.","status":"published","published":"2018-08-06T21:33:31Z","modified":"2023-11-08T03:59:12.445573Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}