Executive brief
serverzyy is a Node.js package used to serve static files over HTTP. The package fails to properly sanitize file path requests, allowing attackers to access files outside the intended directory root (such as /etc/passwd on Linux systems). An attacker can exploit this to read sensitive configuration files and private data without authentication.
Technical details
serverzyy contains a directory traversal vulnerability (CWE-22) in its file path resolution logic. The vulnerability allows attackers to use relative path traversal sequences (e.g., ../../) in HTTP GET requests to access files outside the intended root directory. The attack requires network access to a serverzyy instance but no authentication; a simple HTTP request with path traversal sequences is sufficient to retrieve arbitrary files readable by the process. No patch has been released; the maintainers recommend using the package only for local development and selecting alternative packages for production use.
Affected products
- serverzyy serverzyy 0.0.0 and later
Timeline
- 2017: disclosed: Vulnerability reported as CVE-2017-16135
- 2020-09-01: advisory: GHSA advisory published