Executive brief
file-static-server is a Node.js module used to serve static files over HTTP. A path traversal vulnerability allows attackers to access arbitrary files on the server by using relative path notation (e.g., "../../../etc/passwd") in HTTP requests, potentially exposing sensitive configuration files and application data.
Technical details
The vulnerability is a CWE-22 path traversal flaw caused by insufficient input sanitization of URL paths. Attackers can bypass intended directory restrictions by sending requests with relative path sequences (../) to navigate outside the intended served directory and access arbitrary files on the server. No authentication is required; the vulnerability is exploitable over the network by any unauthenticated attacker. The vulnerability affects all versions of file-static-server. At the time of public disclosure, no patch was available and the maintainers had not provided a fix.
Affected products
- file-static-server all versions
Timeline
- 2020-09-03: disclosed