Description
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lukejacksonn servor
Default version status: unaffected
1.0.0 to ≤ 4.0.2affected
pkg:npm/servorReferences
- https://github.com/lukejacksonn/servor/pull/70 ↗
- https://github.com/lukejacksonn/servor/commit/ec7d824ea6903c0fb97a452045bbb8335198cbab ↗
- https://github.com/lukejacksonn/servor ↗
- https://www.vulncheck.com/advisories/servor-1.0.0-through-4.0.2-unauthenticated-path-traversal-via-url-encoded-dot-segments ↗