Executive brief
tencent-server is a lightweight Node.js file serving utility commonly used during local development. A directory traversal vulnerability allows unauthenticated attackers to access sensitive files outside the intended root directory (such as /etc/passwd), potentially exposing private system configuration and credentials.
Technical details
The vulnerability is a classic directory traversal (CWE-22) in path resolution: tencent-server does not properly sanitize or validate relative file path traversal sequences (e.g., ../../) in HTTP requests. An unauthenticated, network-accessible attacker can craft requests like "GET /../../../../../../etc/passwd" to read arbitrary files on the system. No authentication, user interaction, or special privileges are required. The vulnerability affects all versions from 0.0.0 onward, and no patch has been released; the advisory recommends restricting use to local development only.
Affected products
- tencent-server tencent-server all versions
Timeline
- 2020-09-01: disclosed