Executive brief
enserver is a simple Node.js HTTP server package commonly used for local development. The package fails to properly validate file path requests, allowing attackers to read arbitrary files on the system by requesting paths with directory traversal sequences (e.g., /../../../etc/passwd). An attacker can access sensitive files outside the intended application directory without authentication.
Technical details
This is a path traversal vulnerability (CWE-22) in enserver, a Node.js HTTP server used primarily for development. The vulnerable component fails to properly canonicalize or validate file paths before serving them, allowing relative path sequences like "../" to escape the intended document root. The attack vector is network-based with no authentication or user interaction required; an attacker simply crafts HTTP GET requests with directory traversal sequences (e.g., GET /../../../../../../etc/passwd). A successful exploit results in unauthenticated information disclosure—an attacker can read arbitrary files readable by the server process, potentially exposing configuration files, source code, or other sensitive data. No patch is available; the advisory recommends restricting use to local development environments only and using alternative packages for production deployments.
Affected products
- enserver enserver 0.0.0 and later
Timeline
- 2020-09-01: disclosed: GHSA-5c6f-jpx7-cwq6 published