Executive brief
servey is a Node.js library used for serving files and content. A path traversal vulnerability allows an attacker to read arbitrary files from the server by manipulating file paths, potentially exposing sensitive configuration files, source code, or other confidential data without requiring authentication.
Technical details
This is a classic path traversal (CWE-22) vulnerability in servey versions before 3.3.2. The vulnerability allows an attacker to bypass directory restrictions and read arbitrary files on the server by using path traversal sequences (e.g., "../"). The attack requires only network access and no authentication or user interaction. An attacker can retrieve the contents of any file readable by the servey process, including sensitive configuration or data files. The vulnerability was patched in version 3.3.2.
Affected products
- servey servey before 3.3.2
Timeline
- 2020-07-20: disclosed: NVD published
- 2020: patched: Fixed in version 3.3.2
- 2021-05-07: advisory: GitHub Security Advisory published