Executive brief
@vivaxy/here is a lightweight Node.js web server that serves files from the working directory. The module is vulnerable to directory traversal attacks, allowing an attacker to access files outside the intended web root, potentially exposing sensitive system files like /etc/passwd. This could lead to unauthorized disclosure of confidential information stored on the server.
Technical details
This vulnerability is a directory traversal (path traversal, CWE-22) flaw in the @vivaxy/here web server component. The server fails to properly validate or sanitize file path requests, allowing an attacker to use path traversal sequences (e.g., `..%2f..%2f`) to navigate outside the configured web root. The attack is trivial to execute via HTTP requests and requires no authentication or special privileges. An attacker can read arbitrary files accessible to the Node.js process, including sensitive configuration files and credentials. The vulnerability was patched in version 3.2.2 (commit 298dbab, dated 2017-12-28); all versions prior to 3.2.2 are affected.
Affected products
- vivaxy here < 3.2.2
Timeline
- 2020-09-01: disclosed
- 2017-12-28: patched: Fix released in version 3.2.2