Executive brief
The glance Node.js module, a tool used for serving files, contains a security flaw that allows unauthorized access to files on the host system. By exploiting this vulnerability, an attacker can bypass directory restrictions to read sensitive files, such as configuration data or system credentials, provided they know the file path. This could lead to the exposure of private company data or system-level information.
Technical details
A path traversal vulnerability (CWE-22) exists in the glance npm package prior to version 3.0.4. The vulnerability is caused by a lack of proper validation for user-supplied input used to construct file paths. An attacker with network access and low-level privileges can provide specially crafted paths (e.g., using dot-dot-slash sequences) to escape the intended directory and read any file on the filesystem that the Node.js process has permissions to access. The issue was addressed in version 3.0.4 by implementing path validation.
Affected products
- jarofghosts glance < 3.0.4
Timeline
- 2018-06-06: disclosed: NVD Published Date
- 2018-07-26: advisory: GitHub Advisory published
- 2018-05-30: patched: Fix committed to repository