Executive brief
xtalk is a Node.js library for file serving. A directory traversal vulnerability allows attackers to access arbitrary files on the server by crafting URLs with "../" sequences, potentially exposing sensitive system files, configuration data, or application secrets without authentication.
Technical details
This is a classic directory traversal (path traversal) vulnerability in the URL path handling of xtalk. An unauthenticated attacker on the network can bypass directory restrictions by inserting "../" sequences into HTTP requests (e.g., GET /../../../../../../etc/passwd) to traverse outside the intended serving root and read arbitrary filesystem paths. The vulnerability exists in all versions from 0.0.2 onwards, and no patch has been released since the package has not been maintained since 2014. The attack requires no authentication or special preconditions beyond network access to the xtalk service.
Affected products
- npm xtalk 0.0.2 and later
Timeline
- 2020-09-01: disclosed