Executive brief
rollup-plugin-serve is a development server plugin commonly used with the Rollup JavaScript bundler. The vulnerability allows attackers to read arbitrary files from the server by using path traversal techniques. An attacker can exploit this remotely to access sensitive files like configuration files, private keys, or source code without any authentication, potentially leading to data theft or further compromise of the development environment.
Technical details
This is a path traversal vulnerability (CWE-22) in the readFile operation of rollup-plugin-serve. The vulnerable component fails to properly sanitize file paths requested by clients, allowing attackers to include directory traversal sequences (e.g., `../`) in their requests to access files outside the intended serving directory. The vulnerability is accessible over the network (AV:N) and requires no authentication (PR:N) or user interaction (UI:N). An attacker can craft HTTP requests to traverse the filesystem and read arbitrary files accessible to the process running the development server. The vulnerability was fixed in version 1.0.2 by implementing proper path sanitization in the file serving logic.
Affected products
- thgh rollup-plugin-serve before 1.0.2
Timeline
- 2021-05-18: disclosed: GHSA-4j46-mp85-mv8c published
- 2020-07-17: patched: CVE-2020-7684 published; version 1.0.2 released with fix