Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 1 September 2020.

Is there a fix for This vulnerability?

A patch was published on 2020: Fixed in version 6.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

serve path validation bypass via URL encoding

Severity: info · Published 2020-09-01

The serve Node.js package contains a security bypass in its ignore/filtering mechanism. Attackers can circumvent file and directory access restrictions by using URL-encoded characters (like %65 for 'e') in their requests, allowing unauthorized access to files that should have been blocked and revealing directory listings of restricted folders.

Technologies: serve (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 1 September 2020.
Which products and versions are affected?: serve (npm) before 6.5.2.
Is there a fix for This vulnerability?: A patch was published on 2020: Fixed in version 6.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a validation-before-canonicalization flaw in the serve library's ignore functionality. Path validation occurs before URL-encoded characters are decoded and paths are canonicalized, allowing attackers to bypass ignore rules by submitting URL-encoded equivalents of blocked filenames (e.g., accessing test.txt as t%65st.txt). The issue affects all versions prior to 6.5.2 and is reachable over the network without authentication. An attacker can access ignored files and enumerate restricted directories by exploiting this path traversal bypass.

Affected products

npm serve before 6.5.2

Timeline

2020-09-01: disclosed
2020: patched: Fixed in version 6.5.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.