Executive brief
liyujing is a Node.js package used for file serving and path resolution. The vulnerability allows attackers to access files outside the intended directory root through crafted requests with path traversal sequences (e.g., ../../etc/passwd), potentially exposing sensitive files like credentials or configuration data. No patch is available, making this a persistent risk in production environments.
Technical details
This is a classic directory traversal vulnerability (CWE-22) in a file-serving library that fails to properly sanitize or validate relative file paths. The vulnerable component resolves user-supplied paths without sufficient canonicalization, allowing attackers to escape the intended root directory using sequences like "../" in HTTP requests. The attack requires no authentication and is remotely exploitable over the network. An attacker can read arbitrary files accessible to the server process, leading to information disclosure. The advisory states no patch is available; users are recommended to restrict use to local development only.
Affected products
- npm liyujing all versions from 0.0.0
Timeline
- 2020-09-01: disclosed
- 2017: other: CVE-2017-16120 assigned