M-Server Cross-Site Scripting Vulnerability

M-Server is a small http static server . M-Server suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

CVE-2018-16484

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

CVE-2018-16485

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

Cross site scripting

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

CVE-2018-16484

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

Path traversal

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

CVE-2018-16485

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

CVE-2018-16485

CVE-2018-16485 describes a directory traversal vulnerability in the m-server Node.js module prior to version 1.4.1. The flaw arises because the server constructs targetPath with req.url using path.join and then serves the file without sanitizing the path, enabling an attacker to read arbitrary fi...

CVE-2018-16484

The CVE-2018-16484 entry concerns m-server prior to 1.4.2, where filenames displayed in directory listings are not escaped, allowing stored XSS via crafted filenames to execute malicious JavaScript/HTML. Affected component: m-server (module used for static HTTP serving); root cause: lack of escap...

CVE-2018-16484

A XSS vulnerability was found in module m-server 1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names...

Path Traversal

Overview Versions of m-server before 1.4.2 are vulnerable to path traversal allowing a remote attacker to display content of arbitrary files from the server. Recommendation Update to version 1.4.2 or later. References - HackerOne Report - Node.js security-wg - GitHub Advisory...

Cross-Site Scripting

Overview Versions of m-server before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that m-server is serving. Recommendation Update to version 1.4.2 or later. References - HackerOne Report - Node.js...

Directory Traversal

m-server is vulnerable to directory traversals. The application does not restrict escape characters, allowing a malicious user to traverse the directories using a curl request such as http://localhost:8080/../../../../../../etc/passwd to gain sensitive information...

Cross-Site Scripting (XSS)

m-server is vulnerable to cross-site scripting XSS. It is possible for an attacker to embed an iframe containing malicious Javascript code via filenames. This is due to a lack of output encoding when the m-server displays content of the selected directory...

Node.js third-party modules: [m-server] Path Traversal allows to display content of arbitrary file(s) from the server

I would like to report Path Traversal in m-server module. It allows to read content of any arbitrary file from the server where m-server is installed and run. Module module name: m-server version: 1.4.0 npm page: https://www.npmjs.com/package/m-server Module Description M-Server is a mini http...

Node.js third-party modules: [m-server] HTML Injection in filenames displayed as directory listing in the browser allows to embed iframe with malicious JavaScript code

I would like to report Stored XSS vulnerability in m-server module. m-server displays content of selected directory as HTML in the browser. However, no escape is implemented which allows malicious user to embed executable JavaScript or HTML code eg. to load HTML document into iframe element and...