Executive brief
gomeplus-h5-proxy is a Node.js HTTP proxy utility commonly used during local development. The package fails to properly validate file paths, allowing an attacker to access files outside the intended directory—such as reading /etc/passwd or other sensitive system files. This could expose private configuration files, credentials, or other sensitive data on any system running the proxy.
Technical details
The vulnerability is a directory traversal flaw (CWE-22) in how gomeplus-h5-proxy resolves relative file paths from HTTP requests. An attacker can craft a request containing path traversal sequences (e.g., GET /../../../../../../etc/passwd) to break out of the intended directory root and read arbitrary files on the system. The vulnerability requires only network access to the proxy (no authentication needed) and can be exploited directly via HTTP requests. An attacker can read any file accessible to the proxy process. No patch is available; the maintainers recommend restricting use to local development only and using alternative packages for production deployments.
Affected products
- gomeplus gomeplus-h5-proxy 0 through 1.0.15
Timeline
- 2018-07-24: disclosed
- other: CVE-2017-16037 assigned