Executive brief
localhost-now is a Node.js module used to serve local files over a network. A security flaw in versions prior to 1.0.2 allows an attacker to bypass directory restrictions and access any file on the host system that the application has permission to read. This could lead to the exposure of sensitive configuration files, credentials, or private data, potentially compromising the entire server.
Technical details
The localhost-now Node.js module is vulnerable to a path traversal attack (CWE-22) in versions prior to 1.0.2. The vulnerability stems from a lack of proper validation or sanitization of user-supplied input used to construct file paths. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests containing directory traversal sequences (e.g., '../'). This allows the attacker to escape the intended web root directory and read the contents of arbitrary files on the server's filesystem. The issue was addressed in version 1.0.2 by implementing path validation.
Affected products
- DCKT localhost-now < 1.0.2
Timeline
- 2018-06-06: advisory: NVD published CVE-2018-3729
- 2018-07-25: disclosed: GHSA-2gjg-5x33-mmp2 published
- 2018-07-25: patched: Fix committed in version 1.0.2