Executive brief
Superstatic is a Node.js server tool used to serve static files and configure routing for web applications. An attacker can use path traversal sequences (such as backslashes on Windows or certain Node.js versions) to access files outside the intended web root directory, potentially exposing sensitive configuration files or application source code.
Technical details
The vulnerability is a path traversal (CWE-177) in superstatic versions prior to 5.0.2. On Windows systems, the file serving logic fails to properly normalize and validate paths, allowing attackers to use backslash-based traversal sequences (e.g., ..\) to escape the root directory. Additionally, on non-Windows platforms, the issue affects versions running on Node.js releases (such as v9.9.0) that erroneously normalize backslashes to forward slashes across all platforms, enabling similar attacks. The attack requires network access to the superstatic server and no authentication. An attacker can read arbitrary files accessible to the process. The fix is available in version 5.0.2 and later, which disallows upward tree traversal.
Affected products
- Firebase superstatic before 5.0.2
Timeline
- 2018-02-28: disclosed: Fix PR #255 created
- 2018-07-27: patched: Version 5.0.2 released with fix; advisory published