Executive brief
statics-server is a Node.js package for serving static files. A path traversal vulnerability allows attackers to bypass access controls and read arbitrary files from the server filesystem by using relative path traversal sequences. An attacker can obtain sensitive configuration files, source code, or other confidential data stored on the server.
Technical details
The vulnerability is a classic path traversal (CWE-22) issue caused by insufficient input sanitization when handling file requests. Attackers can craft URLs or requests using relative path sequences (such as ../) to escape the intended file serving directory and access arbitrary files on the server. The vulnerability is network-accessible and does not require authentication. An attacker can read any file readable by the process running statics-server. No patch has been made available for any version of statics-server; the advisory recommends using an alternative module.
Affected products
- statics-server statics-server all versions through 0.0.9
Timeline
- 2019-06-05: disclosed