Executive brief
section2.madisonjbrooks12 is an npm package that fails to properly validate file paths, allowing attackers to read arbitrary files from the hosting system. An unauthenticated attacker can craft malicious requests to access sensitive files like /etc/passwd, potentially exposing system credentials and configuration data.
Technical details
The vulnerability is a directory traversal (CWE-22) in the npm package section2.madisonjbrooks12, which resolves relative file paths without proper sanitization. An attacker can use path traversal sequences (e.g., ../../) in HTTP requests to escape the intended directory root and access arbitrary files on the system. The vulnerability is network-accessible, requires no authentication or user interaction, and allows an attacker to read sensitive files. No patch has been released; the package maintainers recommend using only for local development or switching to an alternative package.
Affected products
- <UNKNOWN> section2.madisonjbrooks12 all versions
Timeline
- 2020-09-01: disclosed
- other: CVE-2017-16172 assigned