Executive brief
iter-server is a Node.js package used to serve files locally during development. The vulnerability allows attackers to bypass directory restrictions and read arbitrary files from the server, such as configuration files or private data stored on the system.
Technical details
The vulnerability is a directory traversal flaw (CWE-22) in iter-server's file path resolution logic. The server fails to properly sanitize or validate relative file paths, allowing an attacker to use path traversal sequences like `/../` to escape the intended document root. An unauthenticated attacker can craft HTTP requests (e.g., `GET /../../../../../../etc/passwd`) to access files outside the intended directory. The vulnerability is remotely exploitable with no authentication required. No patch is available; the vendor recommends using the package only for local development.
Affected products
- npm iter-server all versions from 0.0.0
Timeline
- 2020-09-01: disclosed
- other: CVE-2017-16183 assigned