Executive brief
serve-here is a lightweight npm package that serves local files over HTTP for development and testing purposes. A path traversal flaw allows attackers to bypass directory restrictions and download arbitrary files from the server using crafted URLs with relative path sequences (e.g., "../../../etc/passwd"), potentially exposing sensitive configuration files and source code.
Technical details
The vulnerability is a classic path traversal (CWE-22) in serve-here versions prior to 1.2.0, where the HTTP server fails to properly sanitize or validate URL paths before serving files. An attacker can use relative path traversal sequences such as "../" to navigate outside the intended served directory and access files anywhere on the filesystem that the server process has permission to read. No authentication or special preconditions are required—any network-adjacent client making HTTP requests can exploit this. The fix was merged in December 2017 and is available in version 1.2.0 and later.
Affected products
- npm serve-here before 1.2.0
Timeline
- 2019-07-05: disclosed
- 2017-12-28: patched: Fix merged in PR #17; version 1.2.0+ contains the patch