Executive brief
node-server-forfront is a Node.js package used to serve files locally during development. The package fails to properly validate file paths, allowing attackers to use path traversal sequences (like `../../`) to access sensitive files outside the intended directory, such as system configuration files or private keys. An attacker with network access can retrieve unauthorized files without authentication, potentially exposing private data stored on the server.
Technical details
node-server-forfront contains a directory traversal vulnerability (CWE-22) where relative file paths are not properly sanitized before being resolved. An attacker can craft HTTP requests using path traversal sequences (`../../`) to navigate outside the intended document root and access arbitrary files on the filesystem. The vulnerability requires only network access with no authentication required. A successful exploit allows reading sensitive files such as `/etc/passwd` or other private application data. No patch is available; the advisory recommends using this package only for local development and substituting an alternative package for production use.
Affected products
- npm node-server-forfront ≤0.10.7
Timeline
- 2018-07-23: disclosed
- other: CVE-2017-16124 assigned