Executive brief
mockserve is a Node.js library used to serve mock responses during local development. A directory traversal vulnerability allows attackers to read arbitrary files on the system by crafting requests with path sequences like "../../", potentially exposing sensitive configuration files, private keys, or other confidential data.
Technical details
The vulnerability is a directory traversal flaw (CWE-22) in mockserve versions through 2.0.6, where the application fails to properly sanitize or restrict relative file paths. An unauthenticated attacker can send HTTP requests containing path traversal sequences (e.g., GET /../../../../../../etc/passwd) to access files outside the intended directory root. The attack requires only network access to a running mockserve instance and no user interaction. An attacker can read arbitrary files with the permissions of the process, resulting in information disclosure. No patch has been released; the vulnerability remains unfixed in all released versions.
Affected products
- mockserve mockserve through 2.0.6
Timeline
- 2018-07-23: disclosed
- other: CVE-2017-16146 assigned