Executive brief
http-file-server is a Node.js package that serves files over HTTP. An attacker can inject malicious JavaScript code into filenames; when victims view or interact with these files through the server interface, the JavaScript executes in their browser, potentially allowing theft of sensitive information or session hijacking.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw caused by insufficient input sanitization of filenames. The server fails to properly escape or validate file names before displaying them in HTML responses, allowing an attacker to craft files with names containing JavaScript code (e.g., "<img src=x onerror=alert('xss')>"). When a user browses or accesses the served directory, the malicious script executes in their browser context with the privileges of that session. The attack requires network access to the http-file-server instance and user interaction (visiting the affected page). As of the advisory date, no patch is available.
Affected products
- npm http-file-server all versions through 0.2.6
Timeline
- 2019-07-31: disclosed
- 2019-07-30: other: NVD published