Executive brief
quickserver is a lightweight HTTP server library commonly used in Node.js development. The vulnerability allows an attacker to request files outside the intended directory root (e.g., /etc/passwd) by sending crafted HTTP requests with path traversal sequences, potentially exposing sensitive configuration files and private data on the system.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in quickserver's file serving mechanism that fails to properly normalize or validate relative file paths before resolving them. An unauthenticated attacker can exploit this via a simple HTTP GET request containing "../" sequences (e.g., GET /../../etc/passwd) to access files outside the configured document root. No special privileges or user interaction are required; the attack is straightforward over the network. The vulnerability affects all versions up to and including 1.1.0, with no patch available. The advisory recommends restricting use to local development only.
Affected products
- quickserver quickserver 1.1.0 and earlier
Timeline
- 2018-07-23: disclosed