Executive brief
nodeload-nmickuli is an npm package that loads files from the filesystem. A directory traversal vulnerability allows attackers to access files outside the intended directory, potentially exposing sensitive system files and private data stored on the host.
Technical details
The vulnerability is a directory traversal flaw (CWE-22) in how nodeload-nmickuli resolves relative file paths. The package fails to properly sanitize user-supplied paths, allowing sequences like "../../" to traverse up the directory tree. An attacker can send HTTP requests with crafted paths (e.g., GET /../../../../../../etc/passwd) to access arbitrary files on the system. No patch is available; the advisory recommends using the package only for local development.
Affected products
- nmickuli nodeload-nmickuli all versions from 0.0.0
Timeline
- 2020-09-01: disclosed: Advisory published