Executive brief
dcserver is a lightweight Node.js web server package used for local development. The vulnerability allows attackers to bypass directory restrictions and read arbitrary files from the system, such as configuration files or sensitive data, by exploiting improper path handling in HTTP requests.
Technical details
dcserver contains a directory traversal vulnerability (CWE-22) in its path resolution logic, which fails to properly sanitize relative file paths containing traversal sequences like "/../". An attacker can craft HTTP GET requests with path traversal payloads (e.g., GET /../../../../../../etc/passwd) to access files outside the intended directory root. The vulnerability requires no authentication and is reachable over the network with no user interaction. An attacker can achieve arbitrary file read access on the host system. No patch is available; the vendor recommends dcserver be used only for local development and replaced with alternative packages for production deployments.
Affected products
- dcserver dcserver 0.0.0 and later
Timeline
- 2020-09-01: disclosed