Executive brief
dcdcdcdcdc is an npm package that failed to properly validate file paths, allowing attackers to read arbitrary files from the server by crafting requests with path traversal sequences (like `../../`). An attacker can access sensitive system files, configuration files, or private application data, potentially exposing credentials or proprietary information.
Technical details
The vulnerability is a directory traversal (CWE-22) caused by improper resolution of relative file paths. The affected package resolves user-supplied file paths without normalizing or validating them, allowing sequences like `../` to traverse outside the intended directory root. An unauthenticated network attacker can exploit this by sending HTTP GET requests with path traversal payloads (e.g., `GET /../../../../../../etc/passwd`), achieving arbitrary file read on the server. No patch is available; the vendor recommends restricting the package to local development use only.
Affected products
- npm dcdcdcdcdc all versions from 0.0.0
Timeline
- 2020-09-01: disclosed
- 2017: other: CVE-2017-16190 assigned