Executive brief
wintiwebdev is a Node.js development web server used for local development. An unauthenticated attacker can exploit a directory traversal vulnerability to read arbitrary files from the server's filesystem outside the intended directory root, potentially exposing sensitive configuration files, credentials, and source code.
Technical details
The vulnerability is a directory traversal (CWE-22) caused by improper handling of relative file paths in wintiwebdev. An attacker can craft HTTP requests using path traversal sequences (e.g., "../../../../../../etc/passwd") to escape the intended directory root and access arbitrary files on the system. The attack requires network access to the server and no authentication or user interaction. While the CVSS score indicates high severity (7.5, High), the practical impact is limited since the package is intended for local development only. No patch has been released; the recommendation is to use this package only in local development environments and select alternative packages for production use.
Affected products
- npm wintiwebdev 0.0.0 and later
Timeline
- 2020-09-01: advisory: Advisory published