Executive brief
dgard8.lab6 is an npm library that fails to properly validate file paths, allowing attackers to read files outside the intended directory using relative path sequences like ../../../. An attacker can exploit this vulnerability over the network to disclose sensitive files from the server, such as configuration files containing passwords or private keys.
Technical details
The vulnerability is a classic path traversal (CWE-22) issue where the library resolves user-supplied relative file paths without proper normalization or sandboxing. An attacker can craft requests using sequences like /../../../etc/passwd to escape the intended root directory and access arbitrary files on the system. The vulnerability is reachable over the network without authentication or user interaction required. An attacker gains the ability to read any file accessible to the process running the library. No patch has been released; the vendor recommends using the package only for local development and switching to an alternative package for production use.
Affected products
- npm dgard8.lab6 0.0.1 and earlier
Timeline
- 2018-07-23: disclosed