CVE-2018-3718: serve - Improper Handling of URL Encoding
Summary
CVE-2018-3718: vercel/serve allows access to restricted files if filename is URL encoded. Affects serve versions < 6.5.2. Fixed in 6.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The serve node module is an npm package that provides a simple HTTP server for static files. It allows developers to quickly serve static content such as HTML, CSS, and JavaScript files. The package is widely used in web development projects to facilitate local development and testing.
Vulnerability Detail
The serve node module suffers from an improper handling of URL encoding vulnerability. This vulnerability allows access to ignored files if a filename is URL encoded. An attacker can exploit this vulnerability by crafting a specially encoded filename to bypass the intended file access restrictions. This can lead to unauthorized access to sensitive files and potential information disclosure.
How To Fix
Minimum fixed version
6.5.2
This is the first release that contains the fix.
npm install serve@6.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the serve module to the latest version to mitigate the risk.
Conclusion
The serve node module is vulnerable to an improper handling of URL encoding, which can lead to unauthorized access to ignored files. To mitigate this vulnerability, it is crucial to update the serve module to version 6.5.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for serve →
FAQ
This vulnerability allows unauthorized access to ignored files, potentially leading to information disclosure.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the serve module is vulnerable.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the serve module to the latest version to prevent potential exploitation.
No, updating the serve module to the latest version is the recommended solution to mitigate the risk associated with this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-5rc4-8qqh-vq7f/GHSA-5rc4-8qqh-vq7f.json
Related vulnerabilities
Recent vulnerabilities recorded for serve.
