Executive brief
cuciuci is an npm package used for local file serving and development purposes. The package fails to properly validate and sanitize file paths, allowing attackers to request files outside the intended directory root (such as /etc/passwd). This can lead to unauthorized disclosure of sensitive files on systems running vulnerable versions of the package.
Technical details
cuciuci resolves relative file paths without proper canonicalization or validation, resulting in a CWE-22 path traversal vulnerability. An attacker can construct requests using path traversal sequences (e.g., ../../../../../../etc/passwd) to access files outside the intended directory root. The vulnerability is network-accessible and requires no authentication or user interaction. An attacker can read arbitrary files on the system with the privileges of the process running cuciuci. No patch has been released; the recommendation is to limit use to local development only and migrate to an alternative package for production deployments.
Affected products
- npm cuciuci all versions (from 0.0.0)
Timeline
- 2020-09-01: disclosed