Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 2 September 2020.

Is there a fix for This vulnerability?

A patch was published on 2020-09-02: Fixed in version 3.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run glance (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Glance unauthorized file access via dotfile directory traversal

Severity: info · Published 2020-09-02

Glance is a popular Node.js package for serving static files with built-in security features. Versions before 3.0.7 have a flaw in the --nodot option, which is designed to hide files starting with a dot (like .git and .env). The vulnerability allows attackers to bypass this protection and access hidden files stored inside dot-prefixed directories, potentially exposing sensitive configuration files and private source code.

Technologies: glance (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 2 September 2020.
Which products and versions are affected?: glance (npm) prior to 3.0.7.
Is there a fix for This vulnerability?: A patch was published on 2020-09-02: Fixed in version 3.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run glance (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authorization bypass vulnerability in the file filtering logic of the glance static file server. The --nodot option is intended to prevent directory traversal and exposure of hidden files and directories (those beginning with a dot), but the implementation only blocks access to dot-named items at the root level and fails to recursively filter contents inside dot-prefixed directories (e.g., files within .git/). An unauthenticated remote attacker can craft requests to access files inside these hidden directories, such as .git/config or other sensitive files, without requiring any special privileges or user interaction. The vulnerability affects all versions prior to 3.0.7, which introduced a fix for this filtering bypass. No CVE has been assigned.

Affected products

npm glance prior to 3.0.7

Timeline

2020-09-02: disclosed
2020-09-02: patched: Fixed in version 3.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.