Executive brief
simplehttpserver is a lightweight Node.js HTTP server package. The vulnerability allows attackers to access files outside the intended web directory by following symbolic links in URLs, potentially exposing sensitive files on the server. No patch is currently available.
Technical details
The vulnerability is a path traversal (CWE-22) flaw that permits symlink navigation without proper validation. An unauthenticated attacker can craft URLs containing symlinks to traverse the filesystem and access files outside the webroot with read permissions. The attack requires network access to the server and no authentication, but does not allow file modification or code execution. The advisory recommends against production use pending a fix.
Affected products
- npm simplehttpserver 0.3.0 and earlier
Timeline
- 2018-12-06: disclosed