Executive brief
localhost-now is a Node.js package used to serve local files via HTTP for development and testing. The vulnerability allows attackers to read arbitrary files outside the intended server directory by crafting malicious URLs with relative path traversal sequences, potentially exposing sensitive data stored on the server.
Technical details
localhost-now contains a path traversal vulnerability (CWE-22) due to insufficient URL sanitization. An unauthenticated attacker can exploit this over the network by sending requests with relative paths (e.g., "/../../../etc/passwd") to access files outside the configured served directory. No authentication or user interaction is required. The vulnerability affects all versions up to and including 1.0.2, with no fix currently available according to the advisory.
Affected products
- npm localhost-now up to 1.0.2
Timeline
- 2019-03-25: disclosed
- 2019: other: CVE-2019-5416 assigned