Junglewise Threat Intelligence

CVE-2021-23797: http-server-node path traversal via --path-as-is

CVE-2021-23797 · Severity: low · CVSS 3.1 · Published 2022-01-05

Vendors: npm, Unknown.

Executive brief

http-server-node is a lightweight Node.js-based command-line HTTP server used for testing and development. An attacker can exploit a path traversal vulnerability by using the --path-as-is flag to access files and directories outside the intended service root, potentially exposing sensitive source code, configuration files, or other confidential data stored on the server.

Technical details

This is a directory traversal vulnerability (CWE-22) affecting all versions of http-server-node through 1.0.2. The vulnerability exists in the server's path handling logic when the --path-as-is flag is enabled, which fails to properly normalize or validate user-supplied path requests. An unauthenticated attacker with network access can craft HTTP requests using path traversal sequences (such as ../) to navigate outside the intended document root and retrieve arbitrary files from the server's filesystem. No user interaction or authentication is required, making this a network-reachable vulnerability with high confidentiality impact. Patch status is unknown from the advisory.

Affected products

  • <UNKNOWN> http-server-node <=1.0.2

Timeline

  • 2021-12-17: disclosed
  • 2022-01-05: advisory

References