Executive brief
zwserver is a Node.js package that serves files over HTTP. The package fails to properly validate file paths, allowing an attacker to access files outside the intended directory root by using path traversal sequences like "../../../". An attacker could read sensitive files such as configuration files or private application data without authentication.
Technical details
The vulnerability is a directory traversal (CWE-22) in zwserver that stems from insufficient path validation when resolving file requests. The application resolves relative file paths without properly normalizing or restricting them to the intended directory root, allowing attackers to traverse the filesystem using sequences like "/../". The attack vector is network-based and requires no authentication. A malicious HTTP request such as "GET /../../../../../../../../../../etc/passwd" can be used to read arbitrary files on the system. No patch is available; the advisory recommends zwserver be used only for local development.
Affected products
- zwserver zwserver all versions (from 0.0.0)
Timeline
- 2020-09-01: disclosed: GitHub Advisory GHSA-whcm-29f4-j4mx published
- 2017: other: CVE-2017-16149 assigned (based on CVE year)