Junglewise Threat Intelligence

CVE-2017-16146: mockserve directory traversal

CVE-2017-16146 · Severity: low · CVSS 3 · Published 2018-07-23

Vendors: npm.

Executive brief

mockserve is a Node.js library used to serve mock responses during local development. A directory traversal vulnerability allows attackers to read arbitrary files on the system by crafting requests with path sequences like "../../", potentially exposing sensitive configuration files, private keys, or other confidential data.

Technical details

The vulnerability is a directory traversal flaw (CWE-22) in mockserve versions through 2.0.6, where the application fails to properly sanitize or restrict relative file paths. An unauthenticated attacker can send HTTP requests containing path traversal sequences (e.g., GET /../../../../../../etc/passwd) to access files outside the intended directory root. The attack requires only network access to a running mockserve instance and no user interaction. An attacker can read arbitrary files with the permissions of the process, resulting in information disclosure. No patch has been released; the vulnerability remains unfixed in all released versions.

Affected products

  • mockserve mockserve through 2.0.6

Timeline

  • 2018-07-23: disclosed
  • other: CVE-2017-16146 assigned

References