Executive brief
ltt.js is a Node.js package used for serving local files during development. The package fails to properly validate and sanitize file paths, allowing attackers to bypass directory restrictions and access sensitive files outside the intended root directory, such as /etc/passwd or other system files.
Technical details
This is a path traversal vulnerability (CWE-22) in ltt.js caused by improper handling of relative file paths containing directory traversal sequences (../ patterns). An attacker can craft HTTP requests with sequences like /../../../../../../etc/passwd to navigate outside the configured root directory and read arbitrary files on the system. The vulnerability requires network access to a server running ltt.js but no authentication. The vulnerability allows unauthorized file disclosure. No patch has been released; the maintainers recommend using the package only for local development and switching to alternative packages for production use.
Affected products
- npm ltt.js 1.x, including 1.0.0
Timeline
- 2019-05-30: disclosed
- 2019-05-30: advisory