Executive brief
tmock is a lightweight static file server commonly used during local development. The vulnerability allows attackers to read arbitrary files from the server's filesystem by embedding directory traversal sequences (such as "../") in HTTP requests, potentially exposing sensitive configuration files, source code, or other confidential data. This is a critical risk if the tool is ever exposed to untrusted networks or the internet.
Technical details
tmock contains a path traversal vulnerability (CWE-22) in its file serving logic that fails to properly sanitize user-supplied file paths. An unauthenticated attacker can exploit this by crafting HTTP GET requests with "../" sequences to escape the intended document root and access arbitrary files on the filesystem (e.g., GET /../../etc/passwd). The vulnerability requires network access to the tmock server but no authentication or user interaction. An attacker can read any file accessible to the process running tmock. No patch has been released; the vendor recommends the package be used only for local development, or replaced with a secure alternative for production use.
Affected products
- tmock tmock 0.0.7 and earlier
Timeline
- 2018-07-23: disclosed