Executive brief
serverhuwenhui is an npm package used as a simple local web server. It contains a directory traversal vulnerability that allows attackers to read arbitrary files from the server's filesystem by crafting specially-formed URLs with path traversal sequences (e.g., `../../etc/passwd`). An unauthenticated attacker on the network can exploit this to access sensitive files and private data, and no patch is available.
Technical details
This is a directory traversal vulnerability (CWE-22) in the serverhuwenhui npm package, where relative file paths are not properly sanitized. An unauthenticated, network-adjacent attacker can send HTTP requests with traversal sequences (e.g., GET /../../../../../../etc/passwd) to escape the intended document root and read arbitrary files on the system. No authentication or user interaction is required. The attack results in confidential information disclosure. The maintainers have not released a patch and recommend using the package only for local development or switching to an alternative solution.
Affected products
- serverhuwenhui serverhuwenhui 0.0.0 and later (all versions)
Timeline
- 2017: disclosed: CVE-2017-16102 assigned
- 2020-09-01: advisory: GHSA advisory published