Executive brief
mfrs is a Node.js package that serves files locally. It contains a directory traversal vulnerability that allows attackers to read arbitrary files on the system by crafting malicious file path requests. An attacker can exploit this to access sensitive files like system configuration or private application data without authentication.
Technical details
mfrs resolves relative file paths without proper validation, allowing directory traversal attacks (CWE-22). An attacker can use path traversal sequences (e.g., /../../../etc/passwd) in HTTP GET requests to access files outside the intended document root. The vulnerability is network-accessible with no authentication or user interaction required. A successful exploit results in unauthorized information disclosure of arbitrary files readable by the application process. No patch has been released; the vendor recommends using this package only for local development and selecting alternative solutions for production environments.
Affected products
- npm mfrs 0.0.0 and later
Timeline
- 2017: disclosed: CVE-2017-16193 assigned
- 2020-09-01: advisory: GHSA-jjgw-jf33-7fg9 published