Executive brief
wffserve is a Node.js package used to serve files locally during development. A directory traversal vulnerability allows attackers to access sensitive files outside the intended directory root (such as /etc/passwd) by using path traversal sequences in HTTP requests. This can lead to exposure of private configuration files, credentials, or other sensitive data on the developer's machine.
Technical details
The vulnerability is a classic directory traversal (CWE-22) in wffserve's file serving logic. The package fails to properly validate and sanitize relative file paths, allowing an attacker to use sequences like "/.." to navigate outside the intended document root. An unauthenticated attacker over the network can craft malicious HTTP requests (e.g., GET /../../../../../../etc/passwd) to retrieve arbitrary files on the system. No patch is available; the advisory recommends limiting use to local development environments only.
Affected products
- wffserve wffserve all versions
Timeline
- 2020-09-01: disclosed
- 2017: other: CVE-2017-16168 assigned