Executive brief
static-html-server is a Node.js package used to serve static HTML files locally during development. A directory traversal vulnerability allows attackers to access sensitive files outside the intended root directory (such as /etc/passwd on Unix systems) by using relative path sequences like ../../ in HTTP requests. This could lead to disclosure of private configuration files, credentials, or other sensitive information on affected systems.
Technical details
The vulnerability is a classic directory traversal (CWE-22) flaw in which static-html-server fails to properly sanitize or validate relative file paths in HTTP requests. An unauthenticated attacker can craft requests with path traversal sequences (e.g., GET /../../../../../../etc/passwd) to access files outside the configured root directory. The attack requires only network access and no authentication. An attacker can read arbitrary files accessible to the process running the server. No patch has been released; the maintainers recommend using the package only for local development and substituting an alternative for production use.
Affected products
- npm static-html-server 0.1.2 and earlier
Timeline
- 2018-07-23: disclosed
- other: CVE-2017-16152 assigned