Executive brief
rollup-plugin-server is a development tool used to serve bundled JavaScript files during the build process. A security flaw allows an attacker to bypass directory restrictions and access any file on the host system that the server process has permission to read. This could lead to the exposure of sensitive source code, configuration files, or system credentials, potentially compromising the entire development environment.
Technical details
A directory traversal vulnerability exists in all versions of rollup-plugin-server due to a lack of path sanitization in the `readFileFromContentBase` function. Specifically, the `readFile` operation does not validate or normalize user-supplied paths, allowing the use of 'dot-dot-slash' (../) sequences. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP request to the server to traverse outside the intended web root and read sensitive files on the local file system. As of the latest advisory, there is no official patch or fixed version available for this package.
Affected products
- rollup-plugin-server_project rollup-plugin-server All versions up to and including 0.7.0
Timeline
- 2020-06-20: disclosed: Vulnerability disclosed by JHU System Security Lab
- 2020-07-25: advisory: NVD published CVE-2020-7683
- 2020-07-29: advisory: GitHub Advisory GHSA-34gh-3cwv-wvp2 published