Executive brief
desafio is a Node.js package used for serving files locally during development. The package fails to properly validate file paths, allowing attackers to access arbitrary files outside the intended directory, such as sensitive system files or application secrets. This vulnerability poses a risk if the package is exposed over a network or used in production environments.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in desafio's file resolution logic. The package does not properly sanitize or validate relative file paths containing directory traversal sequences like "../", allowing attackers to construct requests that access files outside the intended root directory. An attacker can exploit this by sending HTTP requests with traversal payloads (e.g., GET /../../../../../../etc/passwd) to read arbitrary files on the system. No patch is available; the advisory recommends using the package only for local development and switching to an alternative solution if production functionality is required.
Affected products
- npm desafio 0 to 1.1.0
Timeline
- 2018-08-06: disclosed