CVE-2017-16085: Directory Traversal in tinyserver2

Background

tinyserver2 is an npm package that provides a lightweight server for serving static files. It is designed to be simple and easy to use. However, versions of tinyserver2 up to and including 0.5.2 are vulnerable to a directory traversal attack. This vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.

Vulnerability Detail

The vulnerability in tinyserver2 arises from its handling of relative file paths. By manipulating the file path in a specific way, an attacker can bypass the intended directory restrictions and access files outside of the server's root directory. This can result in the exposure of private files on the vulnerable system. An example request that demonstrates this vulnerability is:

GET /../../../etc/passwd HTTP/1.1 host: foo

This request attempts to access the /etc/passwd file, which contains sensitive user information.

This vulnerability has a severity rating of HIGH and is classified as CWE-22 (Path Traversal).

npm install tinyserver2@0.6.1

npm install tinyserver2@0.6.0

Workaround

If updating to the latest version of tinyserver2 is not possible, a temporary workaround is to implement input validation and sanitization for file paths. This can help prevent directory traversal attacks by ensuring that only valid and safe file paths are accepted by the server. Here is an example of how to sanitize file paths in Node.js:

const path = require('path');

function sanitizeFilePath(filePath) {
  const rootDir = '/path/to/root'; // Replace with the actual root directory
  const resolvedPath = path.resolve(rootDir, filePath);

  if (!resolvedPath.startsWith(rootDir)) {
    throw new Error('Invalid file path');
  }

  return resolvedPath;
}

This code snippet uses the path.resolve() function to resolve the file path relative to the root directory. It then checks if the resolved path is still within the root directory to ensure that no directory traversal has occurred. If the path is deemed invalid, an error is thrown.

Conclusion

In conclusion, the directory traversal vulnerability in tinyserver2 can lead to the disclosure of sensitive files on the vulnerable system. It is crucial to update to version 0.6.0 or later to fix this vulnerability. If updating is not feasible, implementing input validation and sanitization for file paths can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tinyserver2 →

FAQ