Executive brief
node-srv is a lightweight Node.js-based file server used to serve static files over HTTP. A path traversal vulnerability in versions before 2.1.1 allows authenticated attackers to read arbitrary files from the server's filesystem by constructing specially-crafted requests, potentially exposing sensitive configuration files, source code, or other confidential data stored on the server.
Technical details
node-srv contains a path traversal vulnerability (CWE-22) in its file serving logic. The vulnerability occurs because the application does not properly neutralize special path elements (such as "../" sequences) in user-supplied input when constructing file paths. An attacker with low-privilege access (or in some configurations, unauthenticated network access) can craft requests with traversal sequences to escape the restricted directory and read arbitrary files from the server. The attack vector is network-based and requires no user interaction. Exploitation allows read access to sensitive files, potentially leading to information disclosure. The vulnerability was patched in version 2.1.1 and later versions include proper path validation.
Affected products
- npm node-srv < 2.1.1
Timeline
- 2018-06-07: disclosed
- 2018-07-26: advisory
- 2018: patched: Fixed in version 2.1.1