Executive brief
qinserve is a lightweight Node.js package used to serve files locally during development. A directory traversal vulnerability allows an attacker to access files outside the intended directory root by crafting malicious requests with relative path sequences (e.g., `../../etc/passwd`), potentially exposing sensitive system files and configuration data.
Technical details
qinserve fails to properly sanitize relative file path components (CWE-22), allowing directory traversal attacks. An unauthenticated attacker with network access can send HTTP GET requests containing path traversal sequences to traverse outside the configured root directory and access arbitrary files readable by the qinserve process. The vulnerability affects all released versions from 0.0.0 onward. No patch is available; the advisory recommends using qinserve only for local development and employing alternative solutions for production environments.
Affected products
- NPM qinserve 0.0.0 and later
Timeline
- 2020-09-01: disclosed
- 2017: advisory: CVE-2017-16197 assigned