Executive brief
lite-dev-server is a lightweight HTTP file server used for local development. An attacker can read arbitrary files outside the intended public directory by crafting specially-crafted requests with path traversal sequences (e.g., ../), potentially exposing sensitive project files, configuration data, and credentials.
Technical details
This is a directory traversal vulnerability (CWE-22) caused by insufficient input validation on the req.url parameter in the server code. The vulnerable code directly concatenates the request URL to the folder path without sanitization in src/server.js (lines 134, 138), allowing attackers to traverse outside the intended public directory boundary. The isFile() helper function performs no path canonicalization or sandboxing checks. An unauthenticated attacker on the network can send HTTP requests with path traversal sequences (e.g., /../package.json) to read arbitrary files readable by the server process. No patch is available as the project appears unmaintained (last published 3 years ago); users should migrate to alternative development servers with proper input validation.
Affected products
- shadowwzw lite-dev-server all versions up to and including 3.2.7
Timeline
- 2022-10-21: disclosed: Vulnerability disclosed in security research
- 2022-12-21: advisory: GitHub Advisory GHSA-pppv-ch8p-rp2w published; CVE-2022-25895 assigned