Executive brief
uv-tj-demo is a Node.js library used for local development that serves files over HTTP. It contains a directory traversal vulnerability that allows attackers to access sensitive files outside the intended directory, such as system configuration or private application files. An attacker can exploit this by requesting URLs with path traversal sequences (e.g., `../../`) to read arbitrary files on the server.
Technical details
This vulnerability is a classic directory traversal flaw (CWE-22) in file path resolution. The affected versions fail to properly sanitize or validate relative file paths before serving them, allowing an attacker to use sequences like `/../` to escape the intended document root. The vulnerability is reachable via HTTP GET requests and requires no authentication. An attacker can exploit this to read arbitrary files accessible to the process, including system files like `/etc/passwd` or sensitive application data. No patch is available; the developers recommend using the package only for local development and deploying a different solution in production.
Affected products
- npm uv-tj-demo 0.0.0 and later (all versions)
Timeline
- 2020-09-01: disclosed: Advisory published on GitHub
- 2017: other: CVE-2017-16200 assigned