Executive brief
The serve Node.js package contains a security bypass in its ignore/filtering mechanism. Attackers can circumvent file and directory access restrictions by using URL-encoded characters (like %65 for 'e') in their requests, allowing unauthorized access to files that should have been blocked and revealing directory listings of restricted folders.
Technical details
The vulnerability is a validation-before-canonicalization flaw in the serve library's ignore functionality. Path validation occurs before URL-encoded characters are decoded and paths are canonicalized, allowing attackers to bypass ignore rules by submitting URL-encoded equivalents of blocked filenames (e.g., accessing test.txt as t%65st.txt). The issue affects all versions prior to 6.5.2 and is reachable over the network without authentication. An attacker can access ignored files and enumerate restricted directories by exploiting this path traversal bypass.
Affected products
- npm serve before 6.5.2
Timeline
- 2020-09-01: disclosed
- 2020: patched: Fixed in version 6.5.2