Executive brief
m-server is a lightweight Node.js HTTP server used to serve static files and directories. Versions before 1.4.2 contain a stored cross-site scripting vulnerability that can be exploited if an attacker controls the name of a file being served, allowing malicious code injection into the application or pages served to users.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in m-server versions prior to 1.4.2. The root cause is improper sanitization of file names when displaying or serving them; if an attacker can control the name of a file in a directory served by m-server, that unsanitized filename can be reflected in HTML responses without proper encoding. The vulnerability requires an authenticated user or attacker with file upload/control capabilities and user interaction (visiting a page containing the malicious filename). An attacker can inject malicious JavaScript that executes in the context of the application, potentially leading to session hijacking, credential theft, or defacement. The fix is available in version 1.4.2 and later.
Affected products
- m-server m-server before 1.4.2
Timeline
- 2019-02-07: disclosed
- 2019-02-07: patched: Fix available in version 1.4.2 or later