Executive brief
bitty is a Node.js library for serving static files. The package is vulnerable to directory traversal attacks, allowing an attacker to access files outside the intended directory by crafting malicious URLs. This could expose sensitive files and compromise server security.
Technical details
bitty contains a path traversal vulnerability (CWE-22) in its handling of URL paths in GET requests. The application fails to properly neutralize path traversal sequences (e.g., "../" or similar mechanisms) when constructing file paths, allowing attackers to request files outside the intended restricted directory. The vulnerability is exploitable via network-accessible GET requests without authentication. An attacker can retrieve arbitrary files readable by the server process. The package is unmaintained since 2015 and has no patched version available; users should migrate to alternative maintained solutions like the 'serve' module.
Affected products
- <UNKNOWN> bitty 0.2.10 and earlier
Timeline
- 2019-02-18: disclosed
- 2019-02-18: advisory: Published to GitHub Advisory Database