Executive brief
tinyserver2 is a Node.js web server library used to serve static files and web content. The vulnerability allows attackers to read arbitrary files on the system by using specially crafted URLs with path traversal sequences (e.g., /../../../etc/passwd), potentially exposing sensitive configuration files, private keys, or other confidential data stored on the server.
Technical details
This is a directory traversal vulnerability (CWE-22) in tinyserver2's file path resolution logic. The affected versions fail to properly sanitize or normalize relative file paths, allowing attackers to traverse outside the intended document root directory. An unauthenticated attacker can craft HTTP requests with relative path sequences (../) to access arbitrary files on the file system readable by the web server process. No authentication or special preconditions are required—the vulnerability is exploitable directly via HTTP requests. The vulnerability was fixed in version 0.6.0 by properly resolving and validating file paths against the document root.
Affected products
- tinyserver2 tinyserver2 <=0.5.2
Timeline
- 2018-07-24: disclosed