Executive brief
The list-n-stream package, a utility for listing and streaming files, is vulnerable to a security flaw that allows unauthorized access to files on the server. An attacker can use specially crafted web requests to bypass intended directory restrictions and view sensitive system files or application data. This could lead to the exposure of private information and compromise the security of the hosting environment.
Technical details
A directory traversal vulnerability exists in the list-n-stream package (versions 0.0.10 and earlier) due to insufficient validation of user-supplied file paths. The 'serveFile' function in server.js fails to sanitize the 'details.path' parameter, allowing an attacker to use '..' sequences to escape the intended root directory. By sending a crafted network request, an unauthenticated attacker can read any file on the host that the Node.js process has permissions to access. The issue was addressed in version 0.0.11 by implementing a check using path.relative to ensure the resolved path remains within the current working directory.
Affected products
- KoryNunn list-n-stream <= 0.0.10
Timeline
- 2019-05-29: advisory: GitHub reviewed the advisory
- 2021-02-23: disclosed: Advisory published to OSV database
- 0.0.11: patched: Vulnerability fixed in version 0.0.11