Executive brief
Serve is a popular Node.js static file serving utility. Versions before 10.1.2 contain a path traversal vulnerability that allows an attacker to bypass folder exclusion rules and access hidden or restricted files on the server. An attacker can exploit this by crafting requests with relative path sequences to reach directories that administrators intended to hide from public access, potentially exposing sensitive configuration files, source code, or other protected data.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the serve package versions prior to 10.1.2. The root cause is improper handling of relative paths when evaluating folder access controls; explicitly ignored folders can be bypassed using relative path sequences (e.g., "../" sequences). An attacker can send crafted HTTP requests with relative path traversal sequences to navigate past the configured folder exclusions. The attack requires network access to the serve HTTP server but does not require authentication. An attacker can achieve unauthorized file disclosure of hidden folders and files that administrators intended to restrict. The fix is to upgrade to version 10.1.2 or later.
Affected products
- npm serve before 10.1.2
Timeline
- 2020-09-11: disclosed: Vulnerability published in GitHub Advisory Database
- 2020-09-11: patched: Fix available in version 10.1.2