Executive brief
The http-file-server package, a utility used to serve files over HTTP, is vulnerable to a security flaw that allows unauthorized access to files. An attacker can use specially crafted web requests to view files and directories outside of the intended folder. This could lead to the exposure of sensitive system files or configuration data.
Technical details
A path traversal vulnerability (CWE-22) exists in the http-file-server npm module versions up to and including 0.2.6. The vulnerability stems from a failure to properly sanitize URLs, allowing the use of relative path sequences (e.g., '../') to escape the intended web root. A remote, unauthenticated attacker can exploit this by sending crafted HTTP requests to list directories or read arbitrary files on the host system that the process has permissions to access. As of the latest advisory, no official patch has been released, and users are advised to migrate to alternative packages.
Affected products
- npm http-file-server <= 0.2.6
Timeline
- 2019-07-15: advisory: NVD published CVE-2019-5447
- 2019-07-16: disclosed: GitHub Advisory GHSA-2mp5-m968-gwr2 published