Junglewise Threat Intelligence

CVE-2023-26111: node-static directory traversal via path sanitization bypass

CVE-2023-26111 · Severity: low · CVSS 3.1 · Published 2023-03-06

Vendors: npm.

Executive brief

node-static is a popular Node.js module for serving static files over HTTP with built-in caching. A path traversal vulnerability in the file path validation logic allows remote attackers to access files outside the intended root directory. An attacker can craft requests with directory traversal sequences to read sensitive files on the system without authentication.

Technical details

The vulnerability exists in the startsWith() validation logic used to ensure requested paths remain within the configured root directory. The flawed check allows directory names that begin with the root path string to bypass restrictions—for example, if the root is set to `/public`, a request to `/../public-isprivate/file.html` passes validation because the resolved path starts with `/public`, even though it accesses a sibling directory outside the intended scope. This is a classic path traversal flaw (CWE-22). The vulnerability is exploited by sending HTTP requests with `../` sequences or similar path manipulation. No authentication or special privileges are required; the attack is network-accessible. An attacker gains information disclosure capability, allowing arbitrary file read from the filesystem. No patched version exists as of the advisory publication; the npm package node-static remains unfixed as of the advisory date.

Affected products

  • npm node-static 0 through 0.7.11
  • npm @nubosoftware/node-static 0 through 0.7.11

Timeline

  • 2023-03-06: disclosed: Public disclosure via GHSA-5g97-whc9-8g7j and CVE-2023-26111
  • 2022-11-28: other: Vulnerability reported to Snyk

References

Related threats