CVE-2019-5417: Directory Traversal in serve
Summary
CVE-2019-5417: Directory Traversal in serve. Affects serve versions < 7.1.3. Fixed in 7.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The serve package is an npm package used for serving static files locally. It provides a simple command-line interface to start a local server and serve files from a specified directory. The package is commonly used in web development projects to quickly test and preview static content. However, versions of serve before 7.1.3 are vulnerable to a Directory Traversal attack.
Vulnerability Detail
The vulnerability in serve versions before 7.1.3 is due to the lack of proper sanitization of file paths. This allows an attacker to manipulate the file path and access unauthorized system files. By exploiting this vulnerability, an attacker can potentially read sensitive files, modify critical system files, or execute arbitrary code on the target system. The impact of this vulnerability can be severe, leading to unauthorized access and potential compromise of the system.
How To Fix
Minimum fixed version
7.1.3
This is the first release that contains the fix.
npm install serve@7.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The serve package versions before 7.1.3 are vulnerable to a Directory Traversal attack. This vulnerability allows unauthorized access to system files, potentially leading to severe consequences such as unauthorized data access or system compromise. To protect against this vulnerability, it is crucial to upgrade to version 7.1.3 or later of the serve package. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for serve →
FAQ
The serve package is an npm package used for serving static files locally. It provides a simple command-line interface to start a local server and serve files from a specified directory.
Directory Traversal is a vulnerability that allows an attacker to access files and directories outside the intended scope. In this case, it allows unauthorized access to system files.
The potential consequences of this vulnerability include unauthorized access to sensitive files, modification of critical system files, and potential execution of arbitrary code on the target system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and identify any open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the serve package to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for serve.
