Executive brief
html-pages is a Node.js library for serving static HTML pages. A path traversal vulnerability in versions before 2.1.0 allows attackers to access files outside the intended directory, potentially exposing sensitive data or system files on affected servers.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in the html-pages Node.js library affecting all versions before 2.1.0. An attacker can manipulate file paths using relative path traversal sequences (e.g., "../") to read arbitrary files from the server's filesystem. The vulnerability is accessible over the network without authentication or user interaction required. Successful exploitation allows reading of sensitive files including configuration, source code, and system information. The fix is available in version 2.1.0 and later.
Affected products
- Daniel Cardoso html-pages before 2.1.0
Timeline
- 2018-01-30: disclosed: Issue #2 opened reporting security concern
- 2018-05-29: disclosed: NVD published CVE-2018-3744
- 2018-09-18: advisory: GHSA-fm87-46vv-jqrr published
- 2018: patched: Fix available in version 2.1.0 or later