Executive brief
m-server is a Node.js utility for serving files and content from a local directory. An authenticated attacker can exploit a path traversal vulnerability to read arbitrary files from the server by manipulating URL requests with path sequences, potentially exposing sensitive system files or application data. This could lead to unauthorized disclosure of confidential information stored on the affected server.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in m-server versions prior to 1.4.1, where insufficient input validation on URL paths allows an attacker to escape the intended directory root. An authenticated user can append path traversal sequences (such as slashes) to URL requests to access arbitrary files in the directory tree, including sensitive system files like /etc/passwd. The attack requires user authentication and network access to the m-server instance, and allows reading of file contents without modification or availability impact. The issue was fixed in version 1.4.1.
Affected products
- npm m-server <1.4.1
Timeline
- 2019-02-18: disclosed
- 2019-02-18: patched: Version 1.4.1 contains the fix