Executive brief
fast-http is a Node.js library for creating lightweight web servers. It fails to properly validate file paths requested by users, allowing attackers to access files outside the intended directory using directory traversal techniques (e.g., "../" sequences). An attacker can read sensitive files like configuration, source code, or private keys without authentication.
Technical details
This is a path traversal vulnerability (CWE-22) in the fast-http library's file serving functionality. The vulnerability exists in index.js where fs.readFile is called without path sanitization. An attacker can craft requests using "../" sequences or URL-encoded equivalents (%2e%2e) to traverse outside the intended root directory and read arbitrary files. No authentication is required, and the attack is network-accessible. The vulnerability affects all versions through 0.1.3. While a fix was mentioned as being pushed to the master branch, no official patched release was published at the time of disclosure.
Affected products
- npm fast-http 0.1.3 and earlier
Timeline
- 2020-06-20: disclosed: Disclosed by JHU System Security Lab
- 2020-07-27: advisory: Published in GitHub Advisory Database