Executive brief
serverwg is a simple HTTP server package for Node.js. A security flaw allows remote attackers to bypass directory restrictions and access sensitive files on the host system, such as configuration files or system passwords. Because no fix is available, it is recommended to stop using this package in production environments.
Technical details
The serverwg Node.js package is vulnerable to directory traversal (CWE-22) due to insufficient sanitization of input URLs. A remote, unauthenticated attacker can use 'dot-dot-slash' (../) sequences in a GET request to escape the intended web root directory and read arbitrary files on the server's filesystem. For example, a request for '/../../../../etc/passwd' would return the contents of the system password file. As of the latest advisory, no patch is available, and users are advised to migrate to alternative HTTP server packages.
Affected products
- serverwg project serverwg 0.0.0 and later
Timeline
- 2017-05-17: other: Vulnerability demonstrated in PoC
- 2018-06-06: advisory: NVD published CVE-2017-16101
- 2020-09-01: advisory: GitHub Advisory published