CVE-2017-16146: Directory Traversal in mockserve
Summary
CVE-2017-16146: Directory Traversal in mockserve. Affects mockserve versions < 2.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mockserve package is an npm package used for local development. It provides functionality to simulate server responses for testing purposes. However, it is susceptible to a directory traversal vulnerability, which allows a malicious actor to access files outside of the intended directory root. This can lead to the disclosure of private files on the vulnerable system.
Vulnerability Detail
The vulnerability in mockserve arises from the package resolving relative file paths without proper validation. By exploiting this vulnerability, an attacker can craft a request that includes directory traversal sequences, such as '../', to access files outside of the intended directory. For example, an attacker could send a GET request to access the '/etc/passwd' file on the system. This can result in the exposure of sensitive information, such as user credentials or other confidential data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the best workaround is to avoid using the mockserve package in production environments. Instead, it should be limited to local development where the risk of exploitation is lower.
Conclusion
The mockserve package is vulnerable to a directory traversal vulnerability that allows unauthorized access to files outside of the intended directory root. As there is no patch available, it is advised to limit the usage of this package to local development only. For production environments, alternative packages should be considered. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mockserve →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the exposure of sensitive information.
No, there is no patch available for this vulnerability in the mockserve package.
Yes, this vulnerability can be exploited remotely if the affected server is accessible over the network.
There are no known instances of this vulnerability being exploited in the wild.
If you are using the mockserve package, it is recommended to only use it for local development and avoid using it in production environments.
