Executive brief
localhost-now is a lightweight Node.js web server module. An attacker can exploit a path traversal vulnerability to read arbitrary files from the underlying system, including sensitive configuration and credential files, bypassing the intended file access restrictions.
Technical details
The vulnerability is a CWE-22 path traversal bypass in the URL path parsing logic. The vulnerable code attempts to strip "../" sequences using a regex replace, but the regex can be bypassed using encoded or obfuscated path traversal sequences (e.g., "..././"). An attacker with network access to the web server can craft malicious URLs to traverse the file system and read arbitrary files. The vulnerability affects all versions through 1.0.2, which included an earlier (incomplete) path traversal fix. No patch is currently available as of the advisory publication.
Affected products
- localhost-now localhost-now all versions up to and including 1.0.2
Timeline
- 2019-06-11: disclosed
- 2019-06-11: advisory