Executive brief
The http-live-simulator package, used for simulating HTTP services, contains a security flaw that allows unauthorized access to files on the host server. By sending specially crafted requests, an attacker can bypass directory restrictions to read sensitive system files or application data. This could lead to the exposure of credentials, configuration files, or other private information stored on the server.
Technical details
A path traversal vulnerability (CWE-22) exists in http-live-simulator versions prior to 1.0.6. The root cause is insufficient sanitization of user-provided input used to construct file paths. A remote, unauthenticated attacker can exploit this by using relative path sequences (e.g., '../') in HTTP requests to escape the intended directory and read arbitrary files from the underlying file system. The vulnerability is fixed in version 1.0.6.
Affected products
- http-live-simulator project http-live-simulator < 1.0.6
Timeline
- 2019-04-03: advisory: NVD published date
- 2019-04-08: disclosed: GitHub Advisory Database publication