Executive brief
buttle is a Node.js library for serving files from a server. A path traversal vulnerability allows attackers to access sensitive server files by using relative paths in file requests, bypassing intended directory restrictions. No patch is available, and users are advised to switch to alternative libraries.
Technical details
The vulnerability is a classic path traversal (CWE-22) caused by insufficient input sanitization when processing file fetch requests. An unauthenticated attacker on the network can craft requests using relative paths (e.g., "../../../etc/passwd") to escape the intended file serving directory and read arbitrary files from the server. The attack requires no authentication, user interaction, or special conditions. All versions up to and including 0.2.0 are affected. No fix is currently available.
Affected products
- buttle buttle 0.2.0 and earlier
Timeline
- 2018-07-05: disclosed
- 2018-09-18: advisory