Executive brief
lab6.brit95 is an npm package that failed to properly validate file paths, allowing attackers to read files outside the intended directory. An unauthenticated attacker can use specially crafted requests to access sensitive system files like /etc/passwd, potentially exposing credentials or system configuration details.
Technical details
The vulnerability is a classic directory traversal (CWE-22) caused by insufficient validation of user-supplied file paths. The lab6.brit95 package resolves relative path sequences (e.g., ../../) without proper canonicalization or boundary checking, allowing attackers to traverse outside the intended root directory. The vulnerability is exposed over the network with no authentication or user interaction required. An attacker can craft HTTP requests containing path traversal sequences to read arbitrary files on the system (e.g., GET /../../../../../../../../../../etc/passwd). No patch has been released; the vendor recommends the package be used only for local development.
Affected products
- npm lab6.brit95 0.1.1 and earlier
Timeline
- 2018-07-23: disclosed: Advisory published
- 2017: other: CVE-2017-16140 assigned