Executive brief
featurebook is a Node.js package used for displaying feature specifications and documentation. It contains a directory traversal vulnerability that allows attackers to access arbitrary files on the system by crafting malicious requests, potentially exposing sensitive configuration files or private data. The vulnerability is mitigated by the package's design intent not to run in production or be exposed to untrusted networks.
Technical details
featurebook resolves relative file paths without proper validation, allowing directory traversal attacks via the CWE-22 vulnerability class. An attacker can craft HTTP requests with path traversal sequences (e.g., /../../../) to access files outside the intended root directory, such as /etc/passwd. The attack requires network access to a running featurebook instance but no authentication. The vulnerability affects all versions and no direct patch has been released; mitigation relies on restricting deployment to non-production environments not exposed to untrusted networks.
Affected products
- featurebook featurebook all versions
Timeline
- 2020-09-01: disclosed