Executive brief
The serve-index package, a Node.js library used to generate directory listings for web servers, is vulnerable to cross-site scripting. An attacker can use specially crafted file or directory names to execute malicious scripts in the browser of a user viewing the directory index. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in the serve-index middleware for Node.js in versions prior to 1.6.3. The vulnerability is rooted in the improper neutralization of input when generating the HTML for directory listings. Specifically, an attacker can create a file or directory with a name containing malicious HTML or JavaScript; when a user navigates to the directory index, the malicious payload is executed in their browser context. This is a reflected XSS attack vector that requires no authentication but does require user interaction (viewing the affected directory). The issue was addressed in version 1.6.3 by implementing proper escaping of file and directory names.
Affected products
- OpenJS Foundation serve-index < 1.6.3
Timeline
- 2015-08-11: patched: Version 1.6.3 released to address the vulnerability
- 2016-04-20: disclosed: Public disclosure via oss-security mailing list
- 2017-01-23: advisory: NVD advisory published