Executive brief
serverlyr is a Node.js file-serving package used primarily for development purposes. The package fails to properly validate file paths, allowing attackers to read arbitrary files on the server by crafting specially-crafted URLs with directory traversal sequences. An attacker could access sensitive configuration files, private keys, or other confidential data stored on the system without authentication. The package maintainers have not released a patch and recommend using alternative solutions for production deployments.
Technical details
The vulnerability is a classic directory traversal (CWE-22) caused by insufficient path validation when resolving file requests. The serverlyr package does not sanitize relative path sequences (../) in incoming HTTP requests, allowing an attacker to escape the configured root directory and access arbitrary files readable by the server process. The attack is trivial to execute: an unauthenticated remote attacker can send a simple HTTP GET request with path traversal sequences (e.g., GET /../../../../../../etc/passwd) to read files outside the intended directory. No authentication or user interaction is required, and the vulnerability is exploitable over the network with low attack complexity. The disclosed impact is high confidentiality (read access to arbitrary files), with no integrity or availability impact. No patch exists; the advisory recommends restricting the package to local development environments only.
Affected products
- npm serverlyr 0.0.0 and later (all versions)
Timeline
- 2017: disclosed: CVE-2017-16089 assigned
- 2020-09-01: advisory: GHSA-46q2-93hm-52p5 published