Executive brief
mcstatic is a Node.js module used for serving static files. A security flaw allows an attacker to bypass directory restrictions and access sensitive files on the server that should not be public. Because no fix is available, it is recommended to stop using this module immediately.
Technical details
The mcstatic module suffers from a path traversal vulnerability (CWE-22) due to insufficient validation of the 'filePath' input. A remote, unauthenticated attacker can use specially crafted requests (e.g., using '../' sequences) to escape the intended web root directory and read any file on the server that the Node.js process has permissions to access. As of the latest advisory update, no patch has been released, and the package is considered end-of-life or abandoned; users are advised to migrate to a maintained alternative.
Affected products
- mcstatic project mcstatic <= 0.0.20
Timeline
- 2018-06-06: advisory: NVD published CVE-2018-3730
- 2018-07-27: disclosed: GitHub Advisory published