Executive brief
angular-http-server is a lightweight development server used to serve Angular applications locally. A path traversal vulnerability in versions prior to 1.6.0 allows authenticated attackers to read arbitrary files from the server filesystem by crafting malicious file path requests. An attacker with network access and valid credentials could bypass intended directory restrictions and access sensitive configuration files, source code, or other confidential data stored on the server.
Technical details
This vulnerability is a path traversal / directory traversal (CWE-22) flaw in the file path resolution logic of angular-http-server. The affected versions fail to properly sanitize user-supplied file paths when resolving requested files, allowing sequences like "../" to escape the intended document root directory. An attacker with network access can exploit this via crafted HTTP requests to read files outside the designated serving directory. The attack vector is network-based and requires low privilege (authenticated access); no user interaction is required. The fix involved a complete rewrite of the path resolution logic (committed Oct 2018) to properly validate and constrain paths before file access. Affected versions are all releases before 1.6.0; users should update immediately.
Affected products
- angular-http-server angular-http-server < 1.6.0
Timeline
- 2018-06-07: disclosed: Published by NVD
- 2018-07-26: advisory: GitHub Advisory Database publication date
- 2018-10-09: patched: Fix merged to master branch with path resolution rewrite
- 2018-07-26: other: Advisory published; original fix in 1.4.3 was incomplete