Executive brief
http-live-simulator is a Node.js library that simulates HTTP live streaming servers. Versions before 1.0.7 contain a path traversal vulnerability that allows attackers to read arbitrary files from the server's filesystem by using relative path sequences like "/.." in HTTP requests, potentially exposing sensitive data such as configuration files or credentials.
Technical details
The vulnerability is a path traversal (CWE-22) caused by insufficient input sanitization of HTTP request paths. Attackers can exploit this by sending requests containing relative path sequences (e.g., "/../../../etc/passwd") to access files outside the intended directory. The attack requires network access to the server and can be performed without authentication. An attacker can read arbitrary files accessible to the server process, potentially exposing sensitive data. The fix is to upgrade to version 1.0.7 or later.
Affected products
- npm http-live-simulator before 1.0.7
Timeline
- 2019-02-07: disclosed
- 2019: patched: Version 1.0.7 available