Executive brief
open-device is a Node.js library used to serve files from a local directory. Due to improper path handling, an attacker can use directory traversal sequences (like "../../../") to access files outside the intended directory, potentially exposing sensitive system files like /etc/passwd. No patch is available for this vulnerability.
Technical details
The vulnerability is a classic directory traversal (CWE-22) in the open-device library's file path resolution logic. The affected versions (all versions through 4.0.1) fail to properly sanitize or validate relative file paths, allowing an attacker to traverse up the directory tree using "../" sequences. The attack is network-accessible with no authentication or user interaction required, as demonstrated by the example GET request with traversal payloads. An attacker can read arbitrary files accessible to the process, leading to information disclosure. No patch has been released; the advisory recommends restricting the package to local development only.
Affected products
- <UNKNOWN> open-device through 4.0.1
Timeline
- 2018-07-23: disclosed
- 2017: other: CVE-2017-16187 assigned