Executive brief
zero is a Node.js web server library. A path traversal vulnerability in versions prior to 1.0.6 allows attackers to read arbitrary files from the server by supplying specially crafted URLs with relative path sequences, potentially exposing sensitive application data and configuration files.
Technical details
The vulnerability is a path traversal (CWE-22) flaw caused by insufficient input sanitization on URL paths. Attackers can bypass directory restrictions by using relative path traversal sequences (e.g., ../../../) when fetching files through the web server. No authentication is required—the attack is reachable over the network to any exposed zero instance. An attacker can achieve arbitrary file read access to files accessible by the server process. The vulnerability is fixed in version 1.0.6 and later.
Affected products
- zero zero prior to 1.0.6
Timeline
- 2020-09-03: disclosed