Executive brief
Glance is a popular Node.js package for serving static files with built-in security features. Versions before 3.0.7 have a flaw in the --nodot option, which is designed to hide files starting with a dot (like .git and .env). The vulnerability allows attackers to bypass this protection and access hidden files stored inside dot-prefixed directories, potentially exposing sensitive configuration files and private source code.
Technical details
This is an authorization bypass vulnerability in the file filtering logic of the glance static file server. The --nodot option is intended to prevent directory traversal and exposure of hidden files and directories (those beginning with a dot), but the implementation only blocks access to dot-named items at the root level and fails to recursively filter contents inside dot-prefixed directories (e.g., files within .git/). An unauthenticated remote attacker can craft requests to access files inside these hidden directories, such as .git/config or other sensitive files, without requiring any special privileges or user interaction. The vulnerability affects all versions prior to 3.0.7, which introduced a fix for this filtering bypass. No CVE has been assigned.
Affected products
- npm glance prior to 3.0.7
Timeline
- 2020-09-02: disclosed
- 2020-09-02: patched: Fixed in version 3.0.7