Executive brief
unicorn-list is a web framework for Node.js. A security flaw allows attackers to bypass folder restrictions and access sensitive files on the server's filesystem, such as configuration files or system passwords. Because no official fix is available, it is recommended to stop using this package in production environments.
Technical details
A directory traversal vulnerability (CWE-22) exists in the unicorn-list web framework due to improper validation of relative file paths in incoming HTTP requests. An unauthenticated remote attacker can exploit this by sending specially crafted GET requests containing dot-dot-slash (../) sequences. This allows the attacker to escape the intended web root directory and read arbitrary files on the host system that the Node.js process has permissions to access. As of the advisory publication, no patch is available, and the maintainers recommend migrating to a different package for production use.
Affected products
- unicorn-list project unicorn-list <= 1.0.4
Timeline
- 2017-11-08: disclosed: CVE-2017-16131 assigned
- 2018-06-06: advisory: NVD published advisory
- 2018-07-23: advisory: GitHub Advisory Database published advisory