Executive brief
bruteser is a Node.js package used to serve files over HTTP. Versions before 0.1.0 fail to properly validate file paths, allowing attackers to bypass directory restrictions and access arbitrary files on the server using relative path sequences like `../`. This could expose sensitive application files, configuration data, or credentials to unauthorized access.
Technical details
This vulnerability is a classic path traversal (CWE-22) flaw in which the bruteser package does not sanitize user-supplied URLs before accessing the filesystem. An attacker can craft requests using relative path sequences (e.g., `/../../../etc/passwd`) to traverse outside the intended served directory and retrieve arbitrary files. The vulnerability affects all versions prior to 0.1.0 and requires only network access to the server; no authentication is necessary. The fix is available in version 0.1.0 or later, which properly sanitizes and validates file paths.
Affected products
- bruteser < 0.1.0
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Version 0.1.0 or later