Medium

Open Redirect in st

Disclosed: 06.08.2018
Updated: 11.10.2026 10:22

st is a module for serving static files.

An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain.

A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used.

Mitigating factor:

In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. ("%2e%2e", "%2e.", ".%2e").

Code example (provided by Xin Gao):

[example.js]

var st = require('st') 
var http = require('http') 
http.createServer(st(process.cwd())).listen(1337)

bash

$ curl -v http://localhost:1337//cve.mitre.com/%2e%2e
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 1337 (#0)
> GET //cve.mitre.com/%2e%2e HTTP/1.1
> Host: localhost:1337
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< cache-control: public, max-age=600
< last-modified: Fri, 13 Oct 2017 22:56:33 GMT
< etag: "16777220-46488904-1507935393000"
< location: //cve.mitre.com/%2e%2e/
< Date: Fri, 13 Oct 2017 22:56:41 GMT
< Connection: keep-alive
< Content-Length: 30
<
* Connection #0 to host localhost left intact

Recommendation

Update to version 1.2.2 or later.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	st	< 1.2.2	1.2.2

References

CVSS score 6.1/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-601
Platform: npm
Package: st
Disclosed: 06.08.2018
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-72fg-jqhx-c68p - CC BY 4.0

Vulnerability history: st

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 08.2018 08.2020
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 1
Medium 1

Disclosures per year

2018: 1
2019: 0
2020: 1
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 0

31.08.2020

Directory Traversal in st

High · 7.5 CVE-2014-3744 < 0.2.5 0.2.5
06.08.2018

Open Redirect in st this entry

Medium · 6.1 CVE-2017-16224 < 1.2.2 1.2.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application