Executive brief
ponse is a Node.js web server library that serves files to clients. Versions before 2.0.2 fail to properly validate file paths in requests, allowing attackers to read arbitrary files from the server using relative path tricks like "../../../etc/passwd". This could expose sensitive configuration files, credentials, or other data stored on the server.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in URL sanitization. The ponse web server does not properly validate or normalize incoming request paths before serving files, allowing attackers to use relative path sequences (../) to escape the intended document root and access files anywhere on the filesystem. The attack requires only network access to the running service; no authentication is needed. An attacker can retrieve arbitrary readable files from the server, leading to information disclosure. The fix is available in version 2.0.2 and later.
Affected products
- ponse ponse prior to 2.0.2
Timeline
- 2020-09-03: disclosed