Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 11 June 2019.

Which products and versions are affected?

m-server (npm) SEMVER:introduced=0,fixed=1.4.2.

Is there a fix for This vulnerability?

Yes. m-server (npm): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run m-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

m-server path traversal in file serving

Severity: info · Published 2019-06-11

m-server is a lightweight Node.js HTTP server library used to serve files and content. A path traversal vulnerability allows remote attackers to bypass directory restrictions and read arbitrary files from the server's filesystem, potentially exposing sensitive configuration files, source code, or credentials.

Technologies: m-server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 11 June 2019.
Which products and versions are affected?: m-server (npm) SEMVER:introduced=0,fixed=1.4.2.
Is there a fix for This vulnerability?: Yes. m-server (npm): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run m-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

m-server (npm): upgrade to 1.4.2 or later
```
npm install m-server@1.4.2
```

Technical details

A path traversal vulnerability (CWE-22) exists in m-server versions before 1.4.2 in the file serving mechanism. The vulnerability allows a remote attacker to craft requests using directory traversal sequences (e.g., "../" or encoded variants) to bypass intended path restrictions and access arbitrary files on the server. No authentication is required as this affects the HTTP request handling layer. An attacker can read sensitive files including configuration, source code, and system files. The fix is available in version 1.4.2 and later.

Affected products

m-server m-server before 1.4.2

Timeline

2019-06-11: disclosed
2019-06-11: patched: fix available in version 1.4.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.