Executive brief
static-server is a lightweight npm package used to serve static files from a local directory via HTTP. An attacker can bypass path validation to access files outside the intended root directory, potentially exposing sensitive files stored on the same server. This occurs due to improper input sanitization in the path validation function.
Technical details
The vulnerability is a path traversal (CWE-22) caused by flawed input sanitization in the validPath() function of server.js. The function uses indexOf() to check if a resolved path starts with the root path, which fails when a sibling directory name is a substring of another (e.g., public-isprivate can be accessed when public is the root). An unauthenticated attacker with network access to the HTTP server can craft requests using relative path sequences (e.g., /../sibling-dir/file.html) to access files outside the configured root directory. No authentication or user interaction is required. A patch is not available, as the project was last updated 5 years ago and the repository is archived.
Affected products
- npm static-server all versions up to and including 2.2.1
Timeline
- 2023-05-07: disclosed: Vulnerability disclosed on GitHub Gist
- 2023-10-03: advisory: GHSA-v834-rhv4-65m3 published