Executive brief
node-static is a popular Node.js package for serving static files over HTTP. The package fails to properly validate file paths, allowing attackers to crash the server by requesting URLs containing null bytes (e.g., `/%00`). This causes service unavailability and potential operational disruption.
Technical details
node-static fails to sanitize null bytes in user-supplied file paths before passing them to fs.stat(), triggering an unhandled TypeError exception. The vulnerability is a missing input validation on HTTP request paths that contain the NULL character (U+0000). An unauthenticated attacker can remotely exploit this via a crafted HTTP request to a server running the affected package, causing the process to crash and deny service to legitimate users. No authentication or user interaction is required. The fix involves validating and rejecting paths containing null bytes before file system operations.
Affected products
- node-static node-static 0.7.11 and earlier
Timeline
- 2021-09-22: disclosed
- 2019-01-11: other: Fix proposed via pull request #213