CVE-2018-3729: Path Traversal in localhost-now

Background

The localhost-now package is an npm package used for local development and testing purposes. It provides a simple way to create a local server and serve static files. The package is widely used in web development projects. However, versions prior to 1.0.2 are vulnerable to a path traversal attack, which allows a remote attacker to read the content of arbitrary files on the server.

Vulnerability Detail

The vulnerability in localhost-now arises from insufficient input validation. An attacker can exploit this vulnerability by crafting a malicious request that includes directory traversal sequences (e.g., '../') in the file path. When the server processes this request, it does not properly sanitize the file path, allowing the attacker to access files outside the intended directory. This can lead to unauthorized disclosure of sensitive information, such as configuration files or user data. The impact of this vulnerability is rated as HIGH with a CVSS score of 7.5.

npm install localhost-now@1.0.2

Workaround

If updating the package is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing user input for file paths. This can be done by ensuring that the requested file path only contains allowed characters and does not include any directory traversal sequences. Here is an example of how to implement this workaround in Node.js:

const path = require('path');

function sanitizeFilePath(filePath) {
  const allowedChars = /^[a-zA-Z0-9_-]+$/;
  const sanitizedPath = path.normalize(filePath);

  if (!allowedChars.test(sanitizedPath)) {
    throw new Error('Invalid file path');
  }

  return sanitizedPath;
}

Conclusion

The localhost-now package prior to version 1.0.2 is vulnerable to a path traversal attack, which allows an attacker to read arbitrary files on the server. To mitigate this vulnerability, it is crucial to update to version 1.0.2 or later of the package. If immediate update is not possible, implementing a temporary workaround by validating and sanitizing user input for file paths can provide some protection. For more information and assistance, please contact DevNack.com.

See every vulnerability recorded for localhost-now →

FAQ