Executive brief
hekto is a Node.js library used for file serving and content management. A path traversal flaw in versions before 0.2.3 allows unauthenticated attackers on the network to read arbitrary files from the affected system, potentially exposing sensitive configuration files, credentials, or other confidential data.
Technical details
The vulnerability is a classic path traversal flaw (CWE-22) in hekto versions before 0.2.3 that allows remote attackers to bypass directory restrictions and access arbitrary files on the system. The attack requires no authentication and is network-accessible, making it trivial to exploit. By crafting malicious file path requests (e.g., using ../ sequences), an attacker can read the contents of any file readable by the application process. The vulnerability was fixed in version 0.2.3 and later.
Affected products
- npm hekto before 0.2.3
Timeline
- 2018-06-07: disclosed
- 2018-07-26: advisory
- 2018: patched: Fix available in version 0.2.3 or later