Executive brief
droppy is a Node.js file hosting application that allows users to upload and share files. A path traversal vulnerability allows authenticated attackers to read arbitrary configuration files and other sensitive data from the server by manipulating file paths, potentially exposing credentials or system configuration details.
Technical details
This is a path traversal vulnerability (CWE-22) in the droppy file server affecting all versions through 12.2.0. The vulnerability exists in the server's file serving logic, allowing authenticated users to traverse outside intended directories and access arbitrary files on the system. The attack requires network access and valid authentication to the droppy server, but no user interaction. An attacker can read sensitive configuration files and other data not intended to be exposed. No patch is available as the project was archived in October 2020.
Affected products
- droppy droppy all versions through 12.2.0
Timeline
- 2021-05-10: disclosed
- 2020-10-18: other: Project archived by owner