Executive brief
11xiaoli is an npm package that provides file serving functionality for local development. The package fails to properly validate file paths, allowing attackers to request files outside the intended directory using path traversal sequences (e.g., ../../etc/passwd), potentially exposing sensitive system files.
Technical details
This is a CWE-22 path traversal vulnerability in the 11xiaoli npm package. The vulnerable component fails to sanitize or properly resolve relative file paths in HTTP requests, allowing an attacker to navigate outside the intended root directory using sequences like "../". No authentication is required—the vulnerability is accessible via unauthenticated network requests. An attacker can read arbitrary files on the system where the package is running, leading to disclosure of sensitive information. No patch has been released; the advisory recommends discontinuing use in production environments.
Affected products
- 11xiaoli 11xiaoli all versions (0.0.0 and above)
Timeline
- 2020-09-01: disclosed: Published to GitHub Advisory Database
- 2017: other: Original CVE-2017-16160 assigned (vulnerability likely existed earlier)