Executive brief
augustine is a Node.js static file server package. A directory traversal vulnerability allows an attacker with network access to read arbitrary files from the server's filesystem by crafting malicious file path requests. This could expose sensitive configuration files, private keys, or other confidential data stored on the server. The vulnerability affects all versions up to 0.2.3, and the maintainers have not released a patch.
Technical details
This vulnerability is a classic path traversal (CWE-22) flaw in the static file serving logic. The affected versions of augustine fail to properly neutralize relative path components (such as `../`) or absolute path prefixes when resolving requested file paths, allowing attackers to traverse outside the designated document root. The attack vector is network-based, requires low privileges (or unauthenticated access depending on deployment), and no user interaction is needed. An attacker can issue HTTP GET requests with crafted paths (e.g., `GET //etc/passwd`) to retrieve files outside the intended directory, potentially disclosing sensitive system or application files. No patched version exists; the recommended mitigation is to replace augustine with an alternative static file server package that properly validates and sanitizes path requests.
Affected products
- npm augustine <=0.2.3
Timeline
- 2018-09-18: disclosed