Executive brief
cypserver is a local development file server. A directory traversal vulnerability allows an attacker to access files outside the intended directory root by using path traversal sequences in HTTP requests, potentially exposing sensitive system files like /etc/passwd.
Technical details
cypserver fails to properly sanitize relative file paths in HTTP requests, allowing directory traversal attacks via sequences like `/../` (CWE-22). An unauthenticated attacker on the network can craft HTTP requests with traversal payloads to access arbitrary files readable by the server process. No authentication or user interaction is required. An attacker can read sensitive files outside the intended document root. No patch is available; the advisory recommends using the package only for local development and selecting alternative solutions for production deployments.
Affected products
- npm cypserver all versions (introduced in 0.0.0)
Timeline
- 2020-09-01: disclosed
- 2017: advisory: CVE-2017-16191 assigned