Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 3 September 2020.

Which products and versions are affected?

npm (npm) all versions; public (npm) SEMVER:introduced=0.0.0.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run npm (npm) or public (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

npm public path traversal via symlink navigation

Severity: info · Published 2020-09-03

The npm package "public" is a web file serving utility that fails to properly restrict access to files outside its intended directory. An attacker can craft URLs containing symlinks to read arbitrary files from the server's filesystem, potentially exposing sensitive data, configuration files, or application code. No patch has been released, making this a persistent risk for any production deployment.

Technologies: npm (npm), public (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 3 September 2020.
Which products and versions are affected?: npm (npm) all versions; public (npm) SEMVER:introduced=0.0.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run npm (npm) or public (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a path traversal vulnerability (CWE-22) in the npm package "public" that affects all versions from 0.0.0 onward. The root cause is inadequate symlink handling in the URL routing logic—the application resolves symbolic links without proper validation, enabling attackers to escape the webroot directory. The attack vector is network-based with no authentication or special preconditions required; an unauthenticated attacker can send crafted HTTP requests containing symlink paths to access arbitrary files on the system. The vulnerability allows complete circumvention of directory restrictions, potentially leading to unauthorized file disclosure. No fix is currently available; the advisory recommends removing the module from production use or switching to an alternative solution.

Affected products

npm public all versions

Timeline

2020-09-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.