Executive brief
The 'send' library for Node.js, which is used to stream files from the server to clients, contains a vulnerability that can reveal the server's internal root file path. An attacker could use this information to map the server's file system, potentially aiding in more complex attacks or data theft. This issue affects applications using versions of the library older than 0.11.1.
Technical details
A path disclosure vulnerability exists in the 'send' package for Node.js in versions prior to 0.11.1. The flaw allows a remote, unauthenticated attacker to obtain the absolute root path of the application on the server's file system. This is typically classified as an information exposure vulnerability (CWE-200). While the specific exploitation vector is not detailed in the advisory, it is reachable over the network without prior authentication. The issue was addressed in version 0.11.1.
Affected products
- send_project send < 0.11.1
Timeline
- 2015-08-01: disclosed: Approximate date based on CVE assignment year and related advisories
- 2017-01-23: advisory: NVD publication date