Executive brief
looppake is a Node.js package used to serve files and directories. The package fails to properly validate file paths, allowing attackers to access sensitive files outside the intended directory by using path traversal techniques. This could expose private configuration files, credentials, or other sensitive data on systems running vulnerable versions. No security patch has been released.
Technical details
looppake contains a path traversal vulnerability (CWE-22) in its file path resolution logic. The root cause is insufficient sanitization of relative path components, allowing sequences like `/../` to escape the intended directory root. An attacker with network access to a vulnerable looppake instance can send crafted HTTP requests (e.g., `GET /../../../../../../etc/passwd`) to read arbitrary files accessible by the process. No authentication or special preconditions are required—the vulnerability is exploitable through simple HTTP requests. All versions up to and including 3.0.0 are affected, and no patched version exists. The maintainers recommend using the package only for local development and switching to alternative packages for production use.
Affected products
- looppake ≤ 3.0.0
Timeline
- 2018-07-23: disclosed: GHSA published
- 2017: other: CVE-2017-16169 assigned (year inferred from CVE numbering)