Executive brief
express-cart is a Node.js shopping cart application used to power e-commerce functionality on web storefronts. A path traversal vulnerability allows an attacker to access files outside the intended directory structure, potentially exposing sensitive configuration files, source code, or customer data stored on the server.
Technical details
This is a CWE-22 path traversal vulnerability affecting express-cart versions before 1.1.7. The vulnerability enables an attacker to use special path sequences (e.g., "../") to traverse the server's file system and access files outside the application's intended root directory. The vulnerability is remotely exploitable over the network without requiring authentication. An attacker can read arbitrary files from the server, potentially including database credentials, API keys, or customer information. The vulnerability was patched in version 1.1.7.
Affected products
- express-cart express-cart < 1.1.7
Timeline
- 2020-09-01: disclosed
- 2020-09-01: patched: Fixed in version 1.1.7