Quick answers
- Is CVE-2019-5417 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-5417 being exploited in the wild.
- How severe is CVE-2019-5417?
- Low severity, with a CVSS score of 3, published 25 March 2019.
- Which products and versions are affected?
- serve (npm) before 7.1.3.
- Is there a fix for CVE-2019-5417?
- A patch was published on 2019: Version 7.1.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-5417 attacked?
- It is attacked over the network.
- Am I affected by CVE-2019-5417?
- Check whether you run serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A directory traversal vulnerability (CWE-22) exists in serve versions prior to 7.1.3 where file path inputs are not properly sanitized. An attacker can craft malicious file paths using sequences like "../" to traverse up the directory tree and access files outside the intended serving directory. The vulnerability is remotely exploitable without authentication or user interaction. An attacker with network access to the serve instance can read arbitrary files accessible to the process, potentially leading to information disclosure of configuration files, private keys, or other sensitive data. Fixed in serve 7.1.3 and later.
Affected products
- npm serve before 7.1.3
Identifiers
- CVE-2019-5417
- GHSA-xg75-3277-gvvj
Timeline
- 2019-03-25: disclosed
- 2019: patched: Version 7.1.3 released