Executive brief
Mockoon is a mock API server tool that allows developers to simulate backend services for testing. Its static file serving feature is vulnerable to path traversal attacks, allowing an attacker to read arbitrary files from the server's filesystem, including sensitive system files like /etc/passwd. This could expose configuration files, credentials, or other sensitive data stored on the server.
Technical details
The vulnerability is a path traversal and local file inclusion (LFI) flaw in the sendFileWithCallback and sendFile functions. The vulnerable code parses user-supplied request parameters (e.g., query parameters) through a template parser without properly sanitizing path traversal sequences like "../". An attacker can craft requests with URL-encoded traversal sequences (e.g., %2F..%2F..%2Fetc%2Fpasswd) to navigate outside the intended static files directory and read arbitrary files on the server filesystem. No authentication or user interaction is required; the attack is exploitable directly over the network. The vulnerability affects versions up to 9.1.0 of @mockoon/commons-server and @mockoon/cli, with a fix available in version 9.2.0.
Affected products
- Mockoon commons-server <=9.1.0
- Mockoon cli <=9.1.0
Timeline
- 2025-03-11: disclosed
- 2025-03-11: patched: Fixed in version 9.2.0