Executive brief
badjs-sourcemap-server is a Node.js utility for serving source map files during development. A directory traversal vulnerability in the application allows attackers to read arbitrary files from the server by manipulating file path requests, potentially exposing sensitive configuration files, environment variables, and other private data stored on the system.
Technical details
The vulnerability is a classic directory traversal flaw (CWE-22) in badjs-sourcemap-server's file path resolution logic. The application fails to properly sanitize or validate relative file paths containing traversal sequences (e.g., `../`), allowing an unauthenticated network attacker to access files outside the intended directory root via HTTP requests such as `GET /../../../../../../etc/passwd`. All versions up to 0.1.11 are affected. No patch has been released; the vendor recommends restricting the package to local development only.
Affected products
- badjs badjs-sourcemap-server 0 through 0.1.11
Timeline
- 2018-07-24: disclosed: Published as GHSA-xq98-5rcf-5wqh