Executive brief
serve is a popular Node.js package used to serve static files and directories over HTTP. The vulnerability allows attackers to bypass file access restrictions and read arbitrary files from the server's filesystem through directory traversal attacks, potentially exposing sensitive configuration files, credentials, or other protected system files.
Technical details
A directory traversal vulnerability (CWE-22) exists in serve versions prior to 7.1.3 where file path inputs are not properly sanitized. An attacker can craft malicious file paths using sequences like "../" to traverse up the directory tree and access files outside the intended serving directory. The vulnerability is remotely exploitable without authentication or user interaction. An attacker with network access to the serve instance can read arbitrary files accessible to the process, potentially leading to information disclosure of configuration files, private keys, or other sensitive data. Fixed in serve 7.1.3 and later.
Affected products
- npm serve before 7.1.3
Timeline
- 2019-03-25: disclosed
- 2019: patched: Version 7.1.3 released