CVE-2019-15596: Path Traversal in statics-server
Summary
CVE-2019-15596: Path Traversal in statics-server. Affects statics-server versions < 0.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The statics-server package is an open-source npm module used for serving static files. It allows developers to easily create a local server to serve static files such as HTML, CSS, and JavaScript. However, all versions of statics-server are vulnerable to a Path Traversal attack. This means that the package fails to properly restrict access to files outside of the served folder through symlinks.
Vulnerability Detail
The Path Traversal vulnerability in statics-server allows an attacker to access files outside of the intended served folder. By manipulating the file path in the server request, an attacker can traverse the file system and potentially access sensitive files or execute arbitrary code. This can lead to unauthorized access, data leakage, and remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, the best workaround is to use an alternative module that does not have the Path Traversal vulnerability. Make sure to thoroughly review the security of any module you choose to use.
Conclusion
The statics-server package is vulnerable to a Path Traversal attack, which can lead to unauthorized access, data leakage, and remote code execution. Currently, there is no fix available for this vulnerability. It is advised to avoid using statics-server in production environments and to consider using a different module. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for statics-server →
FAQ
statics-server is an npm module used for serving static files locally.
Path Traversal is a vulnerability that allows an attacker to access files outside of the intended directory.
The Path Traversal vulnerability in statics-server can lead to unauthorized access, data leakage, and remote code execution.
No, there is currently no fix available for this vulnerability.
It is recommended to avoid using statics-server in production environments. Consider using an alternative module that does not have this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for statics-server.
