Executive brief
simplehttpserver is a lightweight HTTP server library used to serve files and content. A path traversal vulnerability allows unauthenticated attackers to list and access arbitrary files on the server by crafting malicious directory requests, exposing sensitive data stored on the system.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in simplehttpserver versions prior to 0.2.1 that fails to properly sanitize file path requests. An unauthenticated attacker can exploit this over the network without authentication to enumerate and read files outside the intended document root. The attack requires no special preconditions and can be exploited directly via HTTP requests. An attacker can achieve arbitrary file disclosure, leading to exposure of configuration files, credentials, source code, and other sensitive information stored on the server. The fix is available in version 0.2.1 and later.
Affected products
- npm simplehttpserver <0.2.1
Timeline
- 2018-08-31: disclosed
- 2018-09-06: advisory
- 2018-09-06: patched: Fixed in v0.2.1