Executive brief
simple-npm-registry is a lightweight Node.js package used to serve npm packages locally, typically for development and testing. The vulnerability allows attackers to read arbitrary files from the host system by crafting malicious requests with path traversal sequences (e.g., ../../etc/passwd), potentially exposing sensitive configuration files, source code, and credentials stored on the server.
Technical details
The vulnerability is a classic directory traversal (CWE-22) flaw in simple-npm-registry that fails to properly sanitize or validate relative file paths in HTTP requests. An unauthenticated attacker with network access can craft GET requests containing path traversal sequences (../) to escape the intended package directory and access arbitrary files on the filesystem. The attack requires no authentication or user interaction—a simple HTTP GET request is sufficient. An attacker can read any file readable by the process, including /etc/passwd, configuration files, private keys, and application source code. No patch has been released; the package maintainers recommend using simple-npm-registry only in local development environments and switching to alternatives for production use.
Affected products
- simple-npm-registry simple-npm-registry 0.0.4 and earlier
Timeline
- 2018-07-23: disclosed: Published in GitHub Security Advisory database
- 2017: other: CVE-2017-16132 assigned