Junglewise Threat Intelligence

CVE-2022-25931: easy-static-server directory traversal

CVE-2022-25931 · Severity: low · CVSS 3.1 · Published 2022-12-20

Vendors: npm.

Executive brief

easy-static-server is a lightweight Node.js library for serving static files over HTTP. A path traversal vulnerability allows unauthenticated attackers to read arbitrary files outside the intended static directory by manipulating the request URL with path sequences like "../", potentially exposing sensitive configuration files, source code, or other private data on the server.

Technical details

The vulnerability is a path traversal (CWE-22) caused by missing input sanitization on the req.url parameter. The vulnerable code (line 27 of index.js) joins the root public directory path with user-controlled request paths without resolving or validating for directory traversal sequences. An attacker can send HTTP requests with paths like "/../package.json" to escape the sandboxed directory and access arbitrary files on the filesystem with the permissions of the server process. No authentication is required; the attack is network-accessible. A patch is needed to implement path normalization and validation.

Affected products

  • easy-static-server easy-static-server 0 through 0.1.1

Timeline

  • 2022-10-21: disclosed
  • 2022-12-20: advisory

References