Executive brief
Serve is a popular Node.js package for serving static files over HTTP. A directory traversal vulnerability allows attackers to list the contents of any directory accessible to the process, bypassing intended restrictions on what files can be accessed. While this does not permit reading arbitrary file contents, it can expose sensitive directory structures and aid reconnaissance for further attacks.
Technical details
The vulnerability exists in serve versions prior to 6.4.9 and stems from improper handling of percent-encoded path separators (%2e representing "." and %2f representing "/"). Attackers can craft URLs containing these encoded characters to traverse the directory tree and enumerate directory contents, bypassing path normalization. The attack is network-reachable and requires no authentication. While directory listing is exposed, arbitrary file read is not possible. The fix was merged in PR #316 and released in version 6.4.9, which properly normalizes and scopes paths to the working directory.
Affected products
- Vercel serve prior to 6.4.9
Timeline
- 2018-07-27: disclosed
- 2018-01-23: patched: Fix merged in PR #316