Executive brief
general-file-server is a Node.js module used to serve files over HTTP. A path traversal vulnerability in all versions allows attackers to read arbitrary files on the system, potentially exposing sensitive configuration files, source code, or other confidential data stored on the affected server.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in the general-file-server module affecting all versions up to 1.1.8. An attacker can craft specially-formed requests containing directory traversal sequences (e.g., "../") to access files outside the intended serving directory. No authentication is required; the vulnerability is reachable over the network via HTTP requests without user interaction. The attack allows remote disclosure of arbitrary files readable by the server process. No patch has been released; the advisory recommends discontinuing use of this module.
Affected products
- npm general-file-server all versions up to 1.1.8
Timeline
- 2018-07-26: disclosed
- 2020-06-16: other: GitHub reviewed advisory