Executive brief
intsol-package, a file server utility, contains a security flaw that allows unauthorized access to files on the host system. By sending a specially crafted web request, an attacker can bypass folder restrictions to read sensitive system files, such as configuration data or passwords. This could lead to a full compromise of the server's data and further attacks on the infrastructure.
Technical details
The intsol-package Node.js library, which functions as a file server, is vulnerable to a directory traversal (CWE-22) vulnerability. The root cause is a failure to properly sanitize user-supplied input in the URL path before using it to resolve file locations on the disk. A remote, unauthenticated attacker can exploit this by sending a GET request containing 'dot-dot-slash' (../) sequences to escape the intended web root directory. This allows the attacker to read arbitrary files on the server that the process has permissions to access, such as /etc/passwd. No patch is currently available; users are advised to use the package only for local development or migrate to a maintained alternative for production environments.
Affected products
- intsol-package project intsol-package <= 1.0.0
Timeline
- 2017-05-04: other: Vulnerability demonstrated in proof-of-concept request
- 2018-06-06: disclosed: NVD published date
- 2018-07-23: advisory: GitHub Advisory published