Executive brief
sspa is a simple HTTP file server used for local development. The vulnerability allows attackers to bypass directory restrictions and access sensitive files outside the intended root directory, such as system configuration files or private application data, potentially exposing confidential information.
Technical details
A directory traversal vulnerability (CWE-22) exists in sspa due to improper resolution of relative file paths in HTTP requests. An attacker can craft requests using path traversal sequences (e.g., /../../../etc/passwd) to navigate outside the configured root directory. The vulnerability requires no authentication and is remotely exploitable over the network. An attacker can read arbitrary files accessible to the process, resulting in information disclosure. No patch is available; the maintainers recommend using the package only for local development or switching to an alternative solution for production use.
Affected products
- sspa sspa 0.1.0 and earlier
Timeline
- 2018-07-23: disclosed