Executive brief
easyquick is a Node.js library used for quick file serving and routing in development environments. The vulnerability allows attackers to bypass directory restrictions and access sensitive files outside the intended application directory (such as /etc/passwd), potentially exposing private configuration and system files.
Technical details
easyquick contains a directory traversal vulnerability (CWE-22) in its file path resolution logic. The library fails to properly sanitize relative file paths containing traversal sequences like "../", allowing an attacker to navigate above the intended root directory. The vulnerability is exploitable via HTTP GET requests with crafted paths and requires no authentication or user interaction. An attacker can read arbitrary files on the system where easyquick is running. No patch has been released; vendors are advised to use alternative packages for production deployments.
Affected products
- npm easyquick 0.1.1 and prior
Timeline
- 2018-08-29: disclosed
- other: CVE-2017-16109 assigned