Executive brief
serverabc is a Node.js package used to serve static files over HTTP. A directory traversal vulnerability allows an attacker to bypass path restrictions and read arbitrary files on the system, such as sensitive configuration files or credentials, by using relative path sequences (e.g., ../../) in HTTP requests. No patch is available and the package should only be used for local development.
Technical details
This is a path traversal vulnerability (CWE-22) in the serverabc package that fails to properly validate or sanitize file path inputs. Attackers can exploit this via unauthenticated HTTP GET requests using relative path sequences to traverse outside the intended document root directory. The vulnerable component resolves relative paths without restriction, allowing access to files anywhere on the filesystem readable by the process. No patch has been released; the vulnerability affects all versions up to and including 1.0.0.
Affected products
- serverabc serverabc 0 - 1.0.0
Timeline
- 2018-07-23: disclosed
- other: CVE-2017-16180 assigned