Executive brief
http-server-node is a lightweight Node.js-based command-line HTTP server used for testing and development. An attacker can exploit a path traversal vulnerability by using the --path-as-is flag to access files and directories outside the intended service root, potentially exposing sensitive source code, configuration files, or other confidential data stored on the server.
Technical details
This is a directory traversal vulnerability (CWE-22) affecting all versions of http-server-node through 1.0.2. The vulnerability exists in the server's path handling logic when the --path-as-is flag is enabled, which fails to properly normalize or validate user-supplied path requests. An unauthenticated attacker with network access can craft HTTP requests using path traversal sequences (such as ../) to navigate outside the intended document root and retrieve arbitrary files from the server's filesystem. No user interaction or authentication is required, making this a network-reachable vulnerability with high confidentiality impact. Patch status is unknown from the advisory.
Affected products
- <UNKNOWN> http-server-node <=1.0.2
Timeline
- 2021-12-17: disclosed
- 2022-01-05: advisory