Executive brief
f-serv is a Node.js file serving package that allows web applications to deliver files to users. A path traversal vulnerability in this package enables attackers to bypass directory restrictions and read arbitrary files from the server filesystem by crafting malicious URLs with relative path sequences, potentially exposing sensitive configuration files, source code, or other confidential data.
Technical details
This is a classic path traversal vulnerability (CWE-22) stemming from insufficient input sanitization in URL handling. Attackers can supply relative paths (such as "../../../etc/passwd") when requesting files, allowing them to access files outside the intended serving directory. The vulnerability affects all versions of f-serv and requires no authentication or special privileges—any network attacker can exploit it by issuing malicious HTTP requests. No patch has been released; users should migrate to an alternative file-serving package.
Affected products
- npm f-serv all versions
Timeline
- 2020-09-03: disclosed