Executive brief
nodeaaaaa is a Node.js package used for file operations. A directory traversal vulnerability allows attackers to read arbitrary files outside the intended directory, potentially exposing sensitive system files like configuration data or credentials. No patch is available, making this a critical risk if the package is used in production environments.
Technical details
This is a directory traversal vulnerability (CWE-22) in the nodeaaaaa npm package affecting all versions up to 1.3.0. The vulnerability exists because the package fails to properly validate and sanitize relative file paths before resolving them, allowing an attacker to use path traversal sequences (e.g., ../../) to access files outside the intended root directory. The attack vector is network-based with no authentication or user interaction required; an attacker can craft HTTP requests with traversal payloads to read arbitrary files. The impact is confidentiality breach—unauthorized disclosure of sensitive files on the system. No patch has been released; the recommendation is to avoid production use and replace this functionality with a properly maintained alternative.
Affected products
- nodeaaaaa nodeaaaaa up to 1.3.0
Timeline
- 2018-07-23: disclosed