Executive brief
peiserver is a lightweight Node.js HTTP server package commonly used for local development and testing. A directory traversal vulnerability allows attackers to read arbitrary files from the system by crafting malicious HTTP requests with relative path sequences (e.g., /../../../etc/passwd), potentially exposing sensitive configuration files, credentials, or other private data.
Technical details
The vulnerability is a path traversal (CWE-22) in peiserver's file serving logic that fails to properly sanitize relative file paths. An unauthenticated attacker can send HTTP GET requests containing sequences like "/.." to traverse outside the intended document root and access any file readable by the web server process. No authentication or user interaction is required; the attack is straightforward via a network HTTP request. An attacker can achieve arbitrary file disclosure, reading sensitive files such as /etc/passwd, application configuration files, or private keys. No patch has been released; the vulnerability affects all versions from 0.0.0 onwards, and users are advised to replace the package with an alternative if production use is required.
Affected products
- peiserver peiserver 0.0.0 and later
Timeline
- 2020-09-01: disclosed