CVE-2018-3771: statics-server Cross-site Scripting vulnerability
Summary
CVE-2018-3771: statics-server Cross-site Scripting vulnerability. Affects statics-server versions < 0.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The statics-server package is an npm package used for serving static files over HTTP. It allows developers to easily serve static files such as HTML, CSS, JavaScript, and images. The package provides a simple server that can be used for development or testing purposes. However, versions of statics-server up to 0.0.9 are vulnerable to a Cross-site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in statics-server <= 0.0.9 is due to a lack of HTML escaping when displaying the directory index in the browser. This allows an attacker to inject an iframe tag with a src attribute pointing to a malicious HTML file in the directory. When a user accesses the directory index, the malicious JavaScript code in the iframe will be executed in their browser. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A temporary workaround for this vulnerability is to disable the directory index feature in statics-server. This can be done by modifying the code to remove the code block responsible for generating the directory index. Here is an example of how to disable the directory index:
// ./node_modules/statics-server/index.js, line 18:
if (fs.lstatSync(staticPath).isDirectory()) {
// Disable directory index
// var files = fs.readdirSync(staticPath);
// var lis = '';
// files.forEach((v, i) => {
// if (fs.lstatSync(path.resolve(staticPath, v)).isDirectory()) {
// lis += `<li><a href="${req.url}${v}/">${v}/</a></li>`;
// } else {
// lis += `<li><a href="${req.url}${v}">${v}</a></li>`
// }
// });
// (...)
}
By commenting out the code block, the directory index will not be displayed, reducing the risk of XSS attacks.
Conclusion
The statics-server package up to version 0.0.9 is vulnerable to a Cross-site Scripting (XSS) attack. This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to various malicious activities. To mitigate this vulnerability, it is recommended to implement proper HTML escaping when displaying the directory index and keep the package up to date. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for statics-server →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to various attacks, such as stealing sensitive information, performing actions on behalf of the user, or spreading malware.
While there may not be a publicly known exploit specific to this vulnerability in statics-server, XSS vulnerabilities are commonly targeted by attackers. It is important to address this vulnerability to prevent potential exploitation.
No, only versions up to 0.0.9 of statics-server are affected by this vulnerability. It is recommended to update to the latest version of the package to ensure the vulnerability is patched.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level. It is important to address this vulnerability to mitigate the risk of potential attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for statics-server.
