Executive brief
hcbserver is a Node.js HTTP server package used for local development. The package resolves relative file paths without proper validation, allowing an attacker to access arbitrary files outside the intended directory root. A malicious actor can use specially crafted HTTP requests to read sensitive system files, potentially exposing credentials, private keys, and other confidential data stored on the server.
Technical details
The vulnerability is a classic directory traversal (path traversal, CWE-22) flaw in hcbserver's file serving logic. The affected versions fail to properly validate or sanitize relative path components (e.g., "../") when resolving file paths, allowing an unauthenticated attacker to navigate outside the intended document root via HTTP requests. The attack vector is network-based and requires no authentication or user interaction; an attacker can craft requests like "GET /../../etc/passwd HTTP/1.1" to access arbitrary files with the privileges of the server process. The impact is information disclosure: any file readable by the server process can be accessed. No patch has been released for this vulnerability; the vendor recommends using hcbserver only for local development and choosing a different package for production environments.
Affected products
- npm hcbserver 0.0.0 and all later versions (no patch available)
Timeline
- 2017: disclosed: CVE-2017-16171 assigned
- 2020-09-01: advisory: GHSA-mwj7-r5vc-hmc9 published