Executive brief
iter-http is a Node.js package used to serve static files. A security flaw allows attackers to bypass folder restrictions and access sensitive files on the host server, such as configuration files or system passwords. Because no fix is available, this package should not be used in production environments.
Technical details
The iter-http package for Node.js fails to properly sanitize user-supplied input when resolving file paths. By sending a specially crafted HTTP GET request containing directory traversal sequences (e.g., ../../), a remote, unauthenticated attacker can escape the intended web root directory. This allows for the unauthorized retrieval of arbitrary files from the underlying server's filesystem. As of the latest advisory, no patch has been released; users are advised to migrate to a different static file server for production use.
Affected products
- iter-http project iter-http <= 1.0.13
Timeline
- 2017-11-06: disclosed: CVE assigned
- 2018-06-06: advisory: NVD published date
- 2018-07-24: advisory: GitHub Advisory published