Executive brief
serve is a Node.js static file server commonly used in development and production environments. A path traversal vulnerability allows attackers to bypass folder restrictions by embedding "/./" sequences in URLs, enabling unauthorized access to hidden or restricted files and directories that administrators intended to protect.
Technical details
The vulnerability is a path traversal (CWE-548) in serve versions prior to 7.0.1. The root cause is insufficient validation of the requested file path; explicit folder ignoring rules can be circumvented by including "/./" in the URL path, which is then normalized in a way that bypasses the access control checks. The attack is network-reachable and requires no authentication or user interaction. An unauthenticated attacker can read arbitrary files and access hidden folders that should have been protected. The fix is available in serve version 7.0.1 and later.
Affected products
- Zeit serve before 7.0.1
Timeline
- 2019-03-25: disclosed
- 7.0.1: patched