Executive brief
knightjs is a Node.js library that is vulnerable to a security flaw where it fails to properly validate file paths provided by users. An attacker can exploit this to access and read sensitive files on the server that should normally be restricted. Because there is no official fix available, it is recommended to stop using this library in production environments.
Technical details
A path traversal vulnerability (CWE-22) exists in knightjs versions 0.0.1 and earlier due to insufficient input validation of file paths. By sending specially crafted requests containing directory traversal sequences (e.g., '../'), a remote, unauthenticated attacker can bypass intended directory restrictions. This allows for the unauthorized retrieval of sensitive files from the underlying file system. As of the latest advisory update, no patch has been released, and the recommended mitigation is to migrate away from the package.
Affected products
- knightjs project knightjs <= 0.0.1
Timeline
- 2018-09-01: other: Vulnerability reported via HackerOne
- 2018-11-06: disclosed: CVE-2018-16475 published
- 2018-11-06: advisory: GitHub Advisory GHSA-3hvm-hgpw-rx4j published