Executive brief
datachannel-client is an npm package used for managing data channels in web applications. A directory traversal vulnerability allows attackers to read arbitrary files from the server by crafting requests with path traversal sequences (like ../../), potentially exposing sensitive configuration files and private data. No patch is available; the vendor recommends restricting use to local development only.
Technical details
datachannel-client improperly resolves relative file paths without proper sanitization, allowing a directory traversal attack via CWE-22. An unauthenticated remote attacker can send HTTP requests containing path traversal sequences (e.g., GET /../../../../../../etc/passwd) to escape the intended document root and access arbitrary files on the system. The vulnerability requires no authentication or user interaction and is network-accessible. Exploitation results in confidentiality compromise through unauthorized file disclosure. No patch has been released; the advisory recommends limiting use to local development environments only.
Affected products
- <UNKNOWN> datachannel-client 0 through 1.0.2
Timeline
- 2018-07-23: disclosed