CVE-2018-3787: Path Traversal Vulnerability in simplehttpserver

Background

simplehttpserver is an npm package that provides a basic HTTP server for serving static files. It is commonly used for local development and testing purposes. The package allows users to easily start a server and serve files from a specified directory. However, versions prior to 0.2.1 are vulnerable to a path traversal attack, which allows an attacker to list any file on the server.

Vulnerability Detail

The path traversal vulnerability in simplehttpserver allows an attacker to bypass the intended file serving restrictions and access files outside of the specified directory. By manipulating the file path in the HTTP request, an attacker can traverse directories and retrieve sensitive files that should not be accessible. This can lead to unauthorized disclosure of sensitive information or potential remote code execution if the server is running with elevated privileges.

npm install simplehttpserver@0.3.0

npm install simplehttpserver@0.2.1

Workaround

If upgrading to the latest version is not possible, a temporary workaround is to manually validate and sanitize the file paths in the server code. This can be done by checking if the requested file path is within the allowed directory and rejecting any requests that attempt to access files outside of it. Here is an example of how to implement this workaround in Node.js:

const http = require('http');
const path = require('path');

const server = http.createServer((req, res) => {
  const filePath = path.join(__dirname, 'public', req.url);
  const allowedDirectory = path.join(__dirname, 'public');

  if (!filePath.startsWith(allowedDirectory)) {
    res.statusCode = 403;
    res.end('Forbidden');

return;

  }

  // Rest of the server logic
});

server.listen(3000);

Conclusion

The path traversal vulnerability in simplehttpserver can be mitigated by upgrading to version 0.2.1 or later. If upgrading is not feasible, implementing the provided workaround can help protect against this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for simplehttpserver →

FAQ