Executive brief
serverwzl is a Node.js web server package used primarily during local development. The package fails to properly validate file paths, allowing attackers to access sensitive files outside the intended directory root (such as /etc/passwd). An attacker on the network can exploit this vulnerability to read arbitrary files on the system without authentication.
Technical details
This is a classic directory traversal vulnerability (CWE-22) in the path resolution logic of serverwzl. The package does not properly sanitize or validate relative file paths, allowing attackers to use sequences like "/../" to escape the intended document root. The vulnerability is reachable via network HTTP requests without authentication or user interaction. An attacker can craft malicious GET requests with traversal sequences to read arbitrary files on the system. No patch has been released; users are advised to restrict use to local development only and substitute alternative packages for production deployments.
Affected products
- serverwzl all versions
Timeline
- 2017: disclosed: CVE-2017-16105 assigned
- 2020-09-01: advisory: GHSA-g87g-4x3w-f8jp published