Executive brief
calmquist.static-server is a Node.js library for serving static files locally. The vulnerability allows an attacker to read arbitrary files from the system by crafting requests with directory traversal sequences (e.g., "../../"), potentially exposing sensitive configuration files, credentials, or other confidential data. The library lacks proper path normalization.
Technical details
The vulnerability is a directory traversal flaw (CWE-22) in the path resolution logic of calmquist.static-server versions up to 0.1.1. The library does not properly sanitize or validate relative file paths, allowing attackers to use sequences like "../" to escape the intended directory root. An attacker can craft HTTP GET requests containing directory traversal payloads (e.g., GET /../../../../../../etc/passwd) to access arbitrary files readable by the web server process. No patch has been released; the advisory recommends the package be used only for local development.
Affected products
- calmquist static-server 0.1.1 and earlier
Timeline
- 2018-07-23: disclosed