Executive brief
fancy-server is a Node.js web server library used to serve static files and directories. Versions 0.1.4 and earlier are vulnerable to directory traversal attacks, allowing an attacker to read arbitrary files outside the intended served directory by using path traversal sequences like ../. This could expose sensitive configuration files, source code, or other confidential data stored on the server.
Technical details
The vulnerability is a classic path traversal flaw (CWE-22) in the file serving component of fancy-server. An attacker can bypass directory restrictions by sending requests with traversal sequences (../) in the URL path, enabling read access to files outside the configured serve directory. The attack is network-reachable and requires no authentication or user interaction—any client can craft a malicious request. Versions 0.1.4 and earlier are affected; the advisory recommends upgrading to 0.1.4 or later.
Affected products
- fancy-server fancy-server 0.1.4 and earlier
Timeline
- 2020-08-31: disclosed
- 2020-08-31: advisory