Executive brief
lessindex is a Node.js package used to serve and index files from a web directory. The vulnerability allows attackers to read arbitrary files from the server by crafting requests with path traversal sequences (like `/../`), potentially exposing sensitive data such as configuration files, credentials, or private source code. No patch is available, and the vendor recommends using the package only for local development.
Technical details
lessindex contains a directory traversal vulnerability (CWE-22) in its file path resolution logic, which fails to properly sanitize or validate relative file paths containing parent directory references (e.g., `/../`). The vulnerability is network-reachable and requires no authentication or user interaction—an attacker can directly craft HTTP requests with traversal sequences to escape the intended root directory. An attacker can read arbitrary files accessible to the web server process, including system files and application secrets. No patch has been issued; the maintainer recommends restricting use to local development environments only.
Affected products
- lessindex lessindex all versions from 0.0.0 onward
Timeline
- 2020-09-01: disclosed: Published in GitHub Advisory Database
- 2017: other: CVE-2017-16211 assigned