Executive brief
mcstatic is a Node.js module used to serve static files from a web server. A directory traversal vulnerability allows attackers to bypass path restrictions and access sensitive files on the underlying file system by manipulating URL paths with slashes, potentially exposing confidential data or configuration files.
Technical details
A path traversal vulnerability (CWE-22) exists in mcstatic versions up to 0.0.20 where insufficient input validation on URL paths allows attackers to access files outside the intended static file directory. The vulnerability is exploitable over the network without authentication by appending slashes or path traversal sequences to the URL. An attacker can read arbitrary files accessible to the web server process, compromising confidentiality of sensitive information. No patch is known to be available from upstream.
Affected products
- mcstatic mcstatic <=0.0.20
Timeline
- 2019-02-07: disclosed
- 2018: other: CVE-2018-16482 assigned