Executive brief
nhouston is a Node.js module that serves static files over HTTP. The module fails to properly validate file paths, allowing attackers to use sequences like "../" to access sensitive files outside the intended directory—such as configuration files, application source code, or system files. This can result in unauthorized access to confidential information stored on the server.
Technical details
nhouston contains a path traversal vulnerability (CWE-23) affecting all versions of the module. The vulnerability exists because the module does not adequately sanitize or validate user-supplied file paths before serving them. An unauthenticated attacker on the network can exploit this by crafting requests with directory traversal sequences (e.g., ../) or URL-encoded variants (%2e%2e/) to access files outside the configured document root. The vulnerability is remotely exploitable without authentication or user interaction, allowing information disclosure of arbitrary files readable by the process. No patch is available; the maintainer has been unresponsive, and users are advised to use an alternative module.
Affected products
- nhouston nhouston all versions
Timeline
- 2014-11-13: disclosed: Vulnerability disclosed via Node Security Project
- 2020-08-31: advisory: GHSA-44g9-w23c-5rw7 published in GitHub Advisory Database