Executive brief
serve46 is a lightweight Node.js package used to serve static files for local development. The vulnerability allows an attacker to access files outside the intended directory by manipulating file paths with directory traversal sequences (e.g., `../../`), potentially exposing sensitive system files like `/etc/passwd` and other private data on the affected server.
Technical details
serve46 contains a path traversal vulnerability (CWE-22) in its file resolution logic, where relative file paths containing directory traversal sequences are not properly sanitized. An unauthenticated attacker on the network can craft HTTP requests with path sequences like `/../../../etc/passwd` to access files outside the configured root directory. The attack requires no user interaction or special privileges; the vulnerable code directly resolves these paths without validation. No patch is available; the vendor recommends using serve46 only for local development and switching to alternative packages for production use.
Affected products
- npm serve46 0.0.0 and later
Timeline
- 2017: disclosed: CVE-2017-16148 assigned
- 2020-09-01: advisory: GHSA-qw9c-8p76-3q2x published