Executive brief
static-dev-server is a lightweight local HTTP file server used during development to serve static files. A path traversal vulnerability allows attackers to access files outside the intended root directory by using directory traversal sequences (../) in requests, potentially exposing sensitive files on the developer's system.
Technical details
The vulnerability is a path traversal (CWE-22) affecting static-dev-server's path validation logic. When processing user requests, the server joins user-supplied URI paths with the configured root directory using path.join(), then attempts to validate the result using a flawed check that only verifies if the resolved path begins with the root path string. This string-based validation can be bypassed due to directory names that contain the root path as a substring (e.g., requesting "../public-isprivate/index.html" when root is "public"). The vulnerability affects all versions of the package (1.x series). No patch is currently available. An attacker can access any file readable by the server process by crafting appropriate traversal sequences.
Affected products
- npm static-dev-server 1.x (all versions)
Timeline
- 2022-11-29: disclosed