Executive brief
node-simple-router is a Node.js HTTP routing library used to serve files from a web application. The library fails to properly validate file paths in requests, allowing attackers to use path traversal sequences (like "../../") to access sensitive files such as configuration files, private keys, or system files outside the intended web root. This could lead to exposure of confidential information and compromise the security of the hosted application.
Technical details
The vulnerability is a classic directory traversal flaw (CWE-22) in which node-simple-router does not neutralize path traversal sequences in user-supplied file paths. The root cause is insufficient validation and normalization of relative paths before resolving them against the directory root. An attacker can send HTTP requests with path traversal payloads (e.g., GET /../../../../../../etc/passwd) to access files outside the intended directory. This attack requires no authentication, user interaction, or elevated privileges, and is reachable over the network. The vulnerability allows unauthorized disclosure of arbitrary files with the same privileges as the application process. A patch was released in version 0.10.1, which implements proper path normalization and validation.
Affected products
- npm node-simple-router <= 0.10.0
Timeline
- 2018-07-24: disclosed
- 2018: patched: Fixed in version 0.10.1