Executive brief
serverxxx is a Node.js package used as a simple web server, commonly for local development. The vulnerability allows attackers to bypass directory restrictions and access sensitive files anywhere on the system, such as configuration files or private data, potentially exposing confidential information.
Technical details
This is a directory traversal vulnerability (CWE-22) in serverxxx where the application fails to properly canonicalize or validate file paths. Attackers can use relative path sequences (e.g., ../../../../../../etc/passwd) in HTTP requests to escape the intended document root and read arbitrary files on the system. The vulnerability is network-reachable and requires no authentication or user interaction. No patch has been released; the recommendation is to restrict use to local development environments only and switch to an alternative package if production deployment is required.
Affected products
- serverxxx serverxxx up to 1.0.0
Timeline
- 2018-07-23: disclosed
- other: CVE-2017-16182 assigned