Executive brief
Sapper is a JavaScript framework for building web applications. Versions before 0.27.11 contain a path traversal vulnerability that allows attackers to read arbitrary files from the server by crafting malicious HTTP requests with URL-encoded directory traversal sequences. An attacker could access sensitive configuration files, application source code, or system files like /etc/passwd without authentication.
Technical details
This is a classic path traversal vulnerability (CWE-22) in sapper's request handling. The vulnerability exists because the application fails to properly validate or sanitize URL paths before resolving them to filesystem locations. An attacker can bypass directory restrictions by URL-encoding the traversal sequences (e.g., %252e%252e for ../), allowing navigation to parent directories and access files outside the intended web root. The attack requires only network access to a sapper application running in production mode; no authentication is needed. The fix is available in version 0.27.11 and later.
Affected products
- Sapper Sapper before 0.27.11
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Version 0.27.11 or later