CVE-2019-5447: Path Traversal in http-file-server
Summary
CVE-2019-5447: Path Traversal in http-file-server. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The http-file-server package is an npm package used for serving files over HTTP. It allows users to host files and serve them to clients. However, all versions of http-file-server are vulnerable to Path Traversal. This vulnerability occurs because the package fails to properly sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.
Vulnerability Detail
The Path Traversal vulnerability in http-file-server allows attackers to bypass the intended file serving restrictions and access sensitive files on the server. By manipulating the URL and using relative paths, an attacker can traverse directories and access files that should not be accessible. This can lead to unauthorized disclosure of sensitive information or even remote code execution if the accessed files contain executable code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, a possible workaround is to implement additional server-side checks to validate and sanitize user input. This can include checking for any attempts to access files outside of the intended directory structure and denying such requests. Additionally, it is important to ensure that the server is properly configured to restrict access to sensitive files and directories.
Conclusion
The http-file-server package is vulnerable to a Path Traversal vulnerability that allows attackers to access sensitive files on the server. No fix is currently available, so it is recommended to use an alternative package until a fix is released. Developers should implement additional server-side checks and ensure proper server configuration to mitigate the risk of this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for http-file-server →
FAQ
The impact of this vulnerability can vary depending on the specific server configuration and the sensitivity of the accessed files. In some cases, it can lead to unauthorized disclosure of sensitive information. In more severe cases, it can even result in remote code execution if the accessed files contain executable code.
No, there is currently no fix available for this vulnerability. It is recommended to use an alternative package until a fix is released.
To mitigate the risk of this vulnerability, it is recommended to implement additional server-side checks to validate and sanitize user input. This can include checking for any attempts to access files outside of the intended directory structure and denying such requests. Additionally, ensure that the server is properly configured to restrict access to sensitive files and directories.
Yes, all versions of http-file-server are vulnerable to this Path Traversal vulnerability.
You can find more information about this vulnerability in the official GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-2mp5-m968-gwr2/GHSA-2mp5-m968-gwr2.json
Related vulnerabilities
Recent vulnerabilities recorded for http-file-server.
