Executive brief
crud-file-server is a lightweight Node.js-based file server for hosting and managing files. A path traversal vulnerability in versions before 0.9.0 allows remote attackers to access sensitive files outside the intended served directory by using relative path sequences in URLs, potentially exposing confidential data stored on the server.
Technical details
The vulnerability is a path traversal (CWE-22) caused by insufficient URL sanitization in the file serving logic. The application fails to properly canonicalize directory paths, allowing attackers to craft requests using relative paths (e.g., `../../../etc/passwd`) to escape the configured serve directory and read arbitrary files. The attack requires no authentication or user interaction and is reachable over the network via HTTP requests. An unauthenticated remote attacker can enumerate and download sensitive files from the server filesystem. The fix canonicalizes directory paths to prevent traversal, available in version 0.9.0 and later.
Affected products
- npm crud-file-server <0.9.0
Timeline
- 2018-05-29: disclosed
- 2018-07-18: patched: Version 0.9.0 released with fix