Executive brief
sexstatic is a Node.js module for serving static files. If an attacker can control a filename served through sexstatic, they can inject malicious scripts that execute in the browsers of users accessing those files, potentially stealing session tokens, credentials, or performing actions on their behalf.
Technical details
sexstatic is vulnerable to stored cross-site scripting (XSS) via unescaped or unsanitized filenames. The vulnerability is exploitable if an attacker can control filenames that are served by the module; these filenames are then rendered in HTML output without proper encoding, allowing JavaScript execution in a user's browser. The attack is network-accessible and requires user interaction (clicking a link to the malicious file). No patch is currently available; the module maintainers have not released a fixed version.
Affected products
- sexstatic sexstatic 0 to 0.6.2
Timeline
- 2018-06-01: disclosed
- 2018-10-01: advisory