Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 11 September 2020.

Which products and versions are affected?

serve (npm) SEMVER:introduced=0,fixed=10.0.2.

Is there a fix for This vulnerability?

Yes. serve (npm): upgrade to 10.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

serve Cross-Site Scripting in filename handling

Severity: info · Published 2020-09-11

serve is a lightweight HTTP server commonly used in development workflows to serve static files. The vulnerability allows attackers to execute arbitrary JavaScript in users' browsers by crafting malicious filenames containing embedded scripts. An attacker can trick a user into accessing or downloading a file with a malicious name, leading to session hijacking, credential theft, or malware distribution.

Technologies: serve (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 11 September 2020.
Which products and versions are affected?: serve (npm) SEMVER:introduced=0,fixed=10.0.2.
Is there a fix for This vulnerability?: Yes. serve (npm): upgrade to 10.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

serve (npm): upgrade to 10.0.2 or later
```
npm install serve@10.0.2
```

Technical details

The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the filename handling mechanism of serve versions prior to 10.0.2. The application fails to properly sanitize or encode filenames when displaying them in directory listings or file responses, allowing attackers to inject malicious JavaScript payloads through crafted filenames. The attack requires a user to access a directory listing or file served by a malicious serve instance, but no authentication is required. An attacker can achieve arbitrary JavaScript execution in the victim's browser context, potentially exfiltrating sensitive data or performing actions on behalf of the user. The fix is available in version 10.0.2 and later.

Affected products

serve prior to 10.0.2

Timeline

2020-09-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.