Executive brief
liuyaserver is a Node.js package for serving static files and running a local development server. The package fails to properly validate file paths, allowing an attacker to access files outside the intended directory root by using directory traversal sequences (e.g., `/../../../etc/passwd`). This could expose sensitive system files and private application data.
Technical details
The vulnerability is a classic directory traversal flaw (CWE-22) in path resolution logic. liuyaserver does not properly sanitize or normalize relative file paths containing traversal sequences, allowing attackers to use sequences like `/../` to access parent directories and files outside the intended root directory. The vulnerability is reachable via HTTP GET requests to the web server without authentication. An attacker can read arbitrary files accessible to the process running the server. No patch is available; the vendor recommends using the package only for local development and switching to alternative packages for production use.
Affected products
- npm liuyaserver 0.0.0 and later
Timeline
- 2020-09-01: disclosed
- other: CVE-2017-16170 associated with this vulnerability