CVE-2019-5444: Path Traversal in serve-here.js

Background

serve-here.js is an npm package used for serving files over HTTP. It allows developers to easily create a server and serve files from a specified folder. However, versions prior to 1.2.0 are vulnerable to a path traversal attack. This means that the package fails to properly sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Vulnerability Detail

The path traversal vulnerability in serve-here.js can be exploited by an attacker to access sensitive files on the server. By crafting a malicious URL with a relative path, an attacker can bypass the intended file serving restrictions and retrieve files that should not be accessible. This could lead to unauthorized access to sensitive information or even remote code execution if the accessed files contain executable code.

npm install serve-here.js@1.2.0

Workaround

If updating to the latest version is not possible, a temporary workaround is to manually sanitize the URLs before passing them to serve-here.js. This can be done by ensuring that the requested paths are within the intended served folder and rejecting any requests that try to access files outside of it. Here's an example of how to implement this workaround in Node.js:

const serveHere = require('serve-here.js');
const path = require('path');

const servedFolder = path.join(__dirname, 'public');

const server = serveHere({
  folder: servedFolder,
  sanitizeUrl: (url) => {
    const requestedPath = path.join(servedFolder, url);
    if (!requestedPath.startsWith(servedFolder)) {
      throw new Error('Invalid path');
    }
    return url;
  }
});

server.listen(3000);

Conclusion

serve-here.js versions prior to 1.2.0 are vulnerable to a path traversal attack. Developers should update to the latest version or manually sanitize URLs to prevent this vulnerability. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for serve-here.js →

FAQ