Executive brief
picard is a Node.js package that does not properly validate file paths, allowing attackers to escape the intended directory and read arbitrary files from the system. An attacker can access sensitive files outside the application's intended scope, potentially exposing passwords, configuration files, or other confidential data.
Technical details
The vulnerability is a directory traversal (CWE-22) in the picard npm package that affects all versions up to 0.3.1. The package resolves relative file paths without proper sanitization, allowing an attacker to use path traversal sequences (e.g., "../../") to access files outside the intended root directory. The vulnerability can be exploited via HTTP requests (e.g., GET /../../../../../../etc/passwd). No patch is available; the advisory recommends using the package only for local development and selecting an alternative for production deployments.
Affected products
- picard picard up to 0.3.1
Timeline
- 2018-07-23: disclosed