Executive brief
fsk-server is a Node.js package used to serve files locally during development. The package fails to properly validate file paths, allowing an attacker to request files outside the intended directory root (such as /etc/passwd) and potentially read sensitive system files or application data.
Technical details
The vulnerability is a classic directory traversal (path traversal) vulnerability caused by insufficient input validation of relative file paths. The fsk-server resolves user-supplied paths without proper canonicalization or bounds checking, allowing attackers to traverse up the directory tree using sequences like "../../" to access files outside the intended root directory. This vulnerability is reachable over the network if the server is exposed. The advisory recommends against using fsk-server in production and using an alternative package if the functionality is needed outside local development. No patch has been released.
Affected products
- fsk-server fsk-server all versions
Timeline
- 2020-09-01: disclosed