Executive brief
pytservce is a Node.js package that serves files locally. The package fails to properly validate file paths, allowing an attacker to access files outside the intended directory root (such as /etc/passwd) by using path traversal sequences like "../". An attacker can read sensitive system files and configuration data without authentication.
Technical details
The vulnerability is a classic directory traversal flaw (CWE-22) in pytservce's file path resolution logic. The package does not properly sanitize or validate relative file paths before serving them, allowing an attacker to use sequences like "../../" to escape the intended root directory. The attack is network-reachable via HTTP GET requests and requires no authentication or user interaction. An attacker can read arbitrary files accessible to the process, leading to disclosure of private files, credentials, or system configuration. No patch is available; the package maintainers recommend using pytservce only for local development.
Affected products
- pytservce pytservce all versions
Timeline
- 2020-09-01: disclosed: Advisory published