Executive brief
hostr is a Node.js static file server used to serve web content from a specified directory. The vulnerability allows attackers to bypass directory restrictions and read arbitrary files on the system by crafting malicious URLs with path traversal sequences (../) in GET requests, potentially exposing sensitive data like configuration files or credentials.
Technical details
The vulnerability is a classic directory traversal (CWE-22) flaw in the URL path parsing logic. hostr fails to properly sanitize or validate URL paths, allowing attackers to use ../ sequences to traverse up the directory tree and access files outside the intended serving directory. The attack requires no authentication and is triggered via a simple HTTP GET request with a crafted path. An attacker can read any file accessible to the process, leading to information disclosure. The vulnerability was fixed in version 2.3.6; all versions up to 2.3.5 are affected.
Affected products
- hostr hostr <= 2.3.5
Timeline
- 2016-12-11: disclosed: Directory traversal issue reported on GitHub
- 2018-11-09: advisory: GHSA-xqqr-p362-6rmc published
- 2017: patched: Fixed in version 2.3.6