Executive brief
lite-server is a lightweight Node.js development web server used by developers to serve web applications locally. An attacker who can send HTTP requests to a running lite-server instance can crash the server by crafting a request with specially-formed characters that the URI decoder cannot process, causing the application to exit unexpectedly and making the development environment unavailable.
Technical details
A denial of service vulnerability exists in lite-server's HTTP request handling due to improper error handling in the logging component. When processing incoming HTTP requests, lite-server uses the decodeURI() function within its logger to decode request URIs. If an attacker crafts a request containing control characters or malformed Unicode sequences (such as %c0%2f), the decodeURI() function throws an exception. This exception is not caught by the library, allowing it to propagate to the Node.js runtime, which terminates the process. The vulnerability requires no authentication and is trivially exploitable via a network-accessible server. No patch version has been released as of the advisory publication date (December 2022).
Affected products
- lite-server lite-server all versions up to and including 2.6.1
Timeline
- 2022-12-20: disclosed
- 2022-10-21: other: Vulnerability publicly disclosed on GitHub gist