Executive brief
utahcityfinder is an npm package used to find city information. The package fails to properly validate file paths, allowing attackers to access sensitive files outside the intended directory—such as system configuration files (/etc/passwd)—by crafting malicious requests with path traversal sequences. This could expose private files and sensitive data on systems running the package.
Technical details
The vulnerability is a path traversal (CWE-22) in utahcityfinder where relative file paths are resolved without proper sanitization. An attacker can include directory traversal sequences (../) in HTTP requests to access files outside the intended root directory. The attack is network-reachable, requires no authentication or user interaction, and allows unauthorized disclosure of arbitrary files on the system. No patch is available; the advisory recommends the package only be used in local development environments.
Affected products
- utahcityfinder utahcityfinder 0.0.1 and earlier
Timeline
- 2018-07-23: disclosed
- 2017: other: CVE-2017-16173 assigned