Executive brief
Servst is a lightweight Node.js file server library. Versions before 2.0.3 contain a path traversal vulnerability in the filePath parameter that allows unauthenticated attackers to read arbitrary files from the server by crafting specially-crafted file path requests, potentially exposing sensitive configuration, application code, and system data.
Technical details
The vulnerability is a directory traversal (CWE-22) caused by improper sanitization of the filePath variable in Servst versions before 2.0.3. The flaw allows attackers to use path traversal sequences (e.g., ../) to escape the intended directory and access arbitrary files on the filesystem. The attack is network-reachable and requires no authentication or user interaction. An attacker can read arbitrary files to which the server process has access, leading to information disclosure. The vulnerability was patched in version 2.0.3.
Affected products
- Andrepolischuk Servst before 2.0.3
Timeline
- 2023-01-30: disclosed
- 2023-01-30: patched: Fixed in version 2.0.3