Executive brief
tianma-static is a Node.js static file server used to serve web assets and content. A stored cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts through filenames that are then executed in users' browsers when those files are served, potentially leading to session hijacking, credential theft, or malware distribution. No patch is available; alternative static file servers should be used.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) affecting all versions of tianma-static up to 1.0.4. The root cause is improper sanitization of filenames served by the static server; if an attacker can control the name of a file being served, they can embed JavaScript code that executes in the browser of users who request that file. This is a network-reachable vulnerability requiring no authentication or special preconditions—any user accessing a crafted filename can trigger the XSS payload. An attacker can steal session tokens, credentials, or perform actions on behalf of the victim. No patch has been released by the vendor, making remediation dependent on switching to an alternative static file server.
Affected products
- tianma tianma-static up to 1.0.4
Timeline
- 2018-11-06: disclosed