Executive brief
easy-static-server is a lightweight Node.js library for serving static files over HTTP. A path traversal vulnerability allows unauthenticated attackers to read arbitrary files outside the intended static directory by manipulating the request URL with path sequences like "../", potentially exposing sensitive configuration files, source code, or other private data on the server.
Technical details
The vulnerability is a path traversal (CWE-22) caused by missing input sanitization on the req.url parameter. The vulnerable code (line 27 of index.js) joins the root public directory path with user-controlled request paths without resolving or validating for directory traversal sequences. An attacker can send HTTP requests with paths like "/../package.json" to escape the sandboxed directory and access arbitrary files on the filesystem with the permissions of the server process. No authentication is required; the attack is network-accessible. A patch is needed to implement path normalization and validation.
Affected products
- easy-static-server easy-static-server 0 through 0.1.1
Timeline
- 2022-10-21: disclosed
- 2022-12-20: advisory