I would like to report Path Traversal in serve-here.js. It allows to list any file in another folder of web root.
module name: serve-here.jsversion:1.1.3npm page: https://www.npmjs.com/package/serve-here.js
Serve static files over HTTP
serve-here.js is simply get the path name of url and add it to the web root. it means if you input …/, it will happy add it to web root and you can list the folder you choose. But the trick is web browser or curl are also to try rebuild the url containing …/. I used the burp to make a raw url and send it to server.
install serve-here.js
$ npm install serve-here.js -g
start program
`$ serve-here
start burpsuite and enter the url contain …/. you should see the files in the folder.
{F485810}
filter … in the path name.
Configuration I’ve used to find this vulnerability:
Note: This is the module serve-here.js
not the module serve-here
This vulnerability allows malicious user to list file in the folder. This might expose vectors to attack system with Remote Code Execution, reveals files with usernames and passwords and many other possibilities.