Executive brief
zjjserver is a lightweight web server package for Node.js applications. The vulnerability allows attackers to bypass directory restrictions and access sensitive files on the system, such as password files or configuration data, potentially exposing private information and system secrets.
Technical details
This is a directory traversal vulnerability (CWE-22) in the file path resolution logic of zjjserver. The server fails to properly sanitize relative file paths containing traversal sequences (e.g., "/../"), allowing an unauthenticated attacker over the network to craft malicious HTTP requests that access files outside the intended directory root. An example attack uses GET requests with paths like "/../../../../../../etc/passwd" to read sensitive system files. No patch has been released; the vendor recommends restricting use to local development only.
Affected products
- zjjserver zjjserver 0.0.0 and later
Timeline
- 2020-09-01: disclosed: Published in GitHub advisory database
- 2017: other: CVE-2017-16201 assigned (approximate)