Executive brief
earlybird is an npm package used for local development and file serving. The vulnerability allows attackers to bypass directory restrictions and read arbitrary files from the system, potentially exposing sensitive configuration files, credentials, or other private data stored on the server.
Technical details
earlybird resolves relative file paths without proper validation, enabling a classic directory traversal (CWE-22) vulnerability. An unauthenticated attacker on the network can craft HTTP requests with path traversal sequences (e.g., GET /../../../../../../etc/passwd) to access files outside the intended root directory. The attack requires no authentication or user interaction and can disclose arbitrary files readable by the application process. No patch has been released; the vendor recommends using the package only for local development and switching to alternatives if production functionality is required.
Affected products
- npm earlybird all versions (from 0.0.0)
Timeline
- 2020-09-01: disclosed