Executive brief
ritp is a Node.js package used for local web server functionality. The vulnerability allows attackers to access files outside the intended directory root through path traversal in HTTP requests, potentially exposing sensitive system files like /etc/passwd without requiring authentication.
Technical details
This is a directory traversal (CWE-22) vulnerability in the ritp npm package affecting all versions up to 1.0.5. The vulnerability exists because the package fails to properly sanitize relative file paths in HTTP requests, allowing attackers to use sequences like "../../" to escape the intended directory root. The attack vector is network-based with no authentication or user interaction required. An attacker can read arbitrary files accessible to the process running ritp. No patch is available; the advisory recommends using the package only for local development.
Affected products
- npm ritp all versions through 1.0.5
Timeline
- 2018-08-06: disclosed