Executive brief
sencisho is a Node.js package that provides file serving functionality. The vulnerability allows an attacker to read arbitrary files on the system by injecting path traversal sequences (../) into the URL, potentially exposing sensitive configuration files, credentials, and other confidential data.
Technical details
The vulnerability is a directory traversal (path traversal) flaw in sencisho's file serving mechanism, classified as CWE-22. An attacker can exploit this by sending HTTP GET requests with "../" sequences in the URL path to navigate outside the intended directory and access arbitrary files on the filesystem (e.g., GET /../../../../../../etc/passwd). The vulnerability requires only network access with no authentication or user interaction. All versions up to and including 0.3.3 are affected. No patch is available; the advisory recommends using the package only for local development and selecting an alternative for production use.
Affected products
- sencisho sencisho up to 0.3.3
Timeline
- 2018-07-24: disclosed
- other: CVE-2017-16092 published