Executive brief
shenliru is a Node.js package used for local file serving and development. The vulnerability allows attackers to bypass path restrictions and read arbitrary files from the server's filesystem by using directory traversal sequences (e.g., `/../`), potentially exposing sensitive configuration files, source code, or credentials stored on the system.
Technical details
shenliru contains a path traversal vulnerability (CWE-22) where relative file paths are not properly resolved or sanitized. An attacker can send HTTP requests with directory traversal sequences (e.g., `GET /../../../../../../etc/passwd`) to the vulnerable server to access files outside the intended root directory. The attack requires no authentication or user interaction and is network-accessible. An attacker can read arbitrary files with the permissions of the process running shenliru, potentially disclosing private files and credentials. No patch is available; the recommendation is to use this package only for local development.
Affected products
- shenliru shenliru all versions
Timeline
- 2020-09-01: disclosed: Advisory published on OSV
- other: CVE-2017-16161 assigned earlier