Executive brief
pooledwebsocket is a Node.js library for WebSocket communication. The library fails to properly sanitize file path requests, allowing an attacker to access sensitive files outside the intended directory—such as system configuration files or private application data—by crafting requests with path traversal sequences like "../".
Technical details
This vulnerability is a path traversal (CWE-22) flaw in pooledwebsocket where relative file paths are resolved without proper sanitization. An attacker can send HTTP GET requests with traversal sequences (e.g., "GET /../../../../../../etc/passwd") to access files outside the intended root directory. The vulnerability requires no authentication and is exploitable over the network. A successful exploit results in unauthorized disclosure of sensitive files on the affected system. The fix is available in version 0.0.19 and later.
Affected products
- npm pooledwebsocket before 0.0.19
Timeline
- 2018-07-24: disclosed
- 2018-07-24: patched: Fix available in version 0.0.19