Executive brief
simplehttpserver is a Node.js-based HTTP server library used to serve static files. Due to improper path validation, an attacker can use relative path sequences (e.g., "../") to read files outside the intended directory, potentially exposing sensitive configuration files, source code, or other confidential data stored on the server. This bypasses intended access restrictions and can lead to information disclosure.
Technical details
The vulnerability is a path traversal (directory traversal) flaw caused by insufficient input sanitization on file paths. When processing HTTP requests, the server fails to properly validate or normalize user-supplied paths, allowing attackers to craft requests using relative path components (such as "../") to escape the intended document root and access arbitrary files on the filesystem. The attack is network-accessible with no authentication required; a simple HTTP GET request with a crafted path is sufficient. An attacker can read any file accessible to the server process, including configuration files, private keys, or source code. The fix is to upgrade to version 0.2.1 or later, which should implement proper path canonicalization and validation.
Affected products
- npm simplehttpserver <0.2.1
- npm static-resource-server <=1.7.2
Timeline
- 2019-02-07: disclosed