Executive brief
gaoxuyan is a Node.js package used for serving files. A directory traversal vulnerability allows attackers to access files outside the intended directory by using relative path sequences (e.g., ../../), potentially exposing sensitive system files and private data.
Technical details
This is a path traversal vulnerability (CWE-22) in gaoxuyan where the package fails to properly validate and resolve relative file paths. An attacker can craft requests with directory traversal sequences (../../../) to escape the intended root directory and access arbitrary files on the system. The vulnerability is reachable over the network without authentication, as demonstrated by the example GET request targeting /etc/passwd. No patch has been released; the advisory recommends using the package only for local development.
Affected products
- npm gaoxuyan All versions
Timeline
- 2020-09-01: disclosed
- other: CVE-2017-16153 published