Executive brief
rtcmulticonnection-client is a Node.js library used for real-time communication signaling. A directory traversal vulnerability allows attackers to read arbitrary files from the underlying server by crafting malicious requests with path traversal sequences (e.g., `../../etc/passwd`). This exposes sensitive configuration files, private keys, and other confidential data.
Technical details
The vulnerability exists in rtcmulticonnection-client's file path resolution logic, which fails to properly sanitize relative file paths (CWE-22). An unauthenticated attacker can send HTTP GET requests with directory traversal sequences to access files outside the intended root directory. No authentication or user interaction is required; the vulnerability is network-accessible and affects all versions up to 1.0.5. There is no patch available, and the advisory recommends the package only be used for local development.
Affected products
- <UNKNOWN> rtcmulticonnection-client up to 1.0.5
Timeline
- 2018-07-23: disclosed
- 2017: advisory: CVE-2017-16125 assigned