Executive brief
node-simple-router is a lightweight Node.js routing library used to handle HTTP requests in web applications. A directory traversal vulnerability in versions 0.10.0 and earlier allows attackers to access files outside the intended application directory, potentially exposing sensitive data or configuration files.
Technical details
The vulnerability is a directory traversal (path traversal) issue in node-simple-router affecting versions 0.10.0 and earlier. The router fails to properly sanitize user-supplied path inputs, allowing an attacker to use special sequences (such as ../) to navigate beyond the intended root directory. The vulnerability is network-accessible without authentication. An attacker can exploit this to read arbitrary files accessible to the application process. The issue was fixed in version 0.10.1.
Affected products
- node-simple-router 0.10.0 and earlier
Timeline
- 2021-02-23: disclosed
- 2021-02-23: patched: Fixed in version 0.10.1