Executive brief
lactate is a lightweight Node.js web server for serving static files. A directory traversal vulnerability allows remote attackers to request arbitrary files from the host filesystem that the process has permission to read, potentially exposing sensitive system files like /etc/passwd. This bypasses the web root restriction and grants unauthorized access to data outside the intended directory.
Technical details
This is a directory traversal vulnerability (CWE-22) in the lactate web server that fails to properly sanitize file path requests. An attacker can craft a GET request using path traversal sequences (e.g., %2e%2e for encoded "..") to escape the configured web root and access arbitrary files on the filesystem. The attack requires only network access and no authentication. An attacker can read any file that the lactate process owner has permission to access. No patch has been released; the advisory recommends using an alternative static web server instead.
Affected products
- lactate lactate through 0.13.12
Timeline
- 2018-01: disclosed: Disclosed via HackerOne Node.js Ecosystem Bug Bounty Program
- 2019-06-14: advisory: GitHub Security Advisory GHSA-68gr-cmcp-g3mj published