Directory Traversal

m-server is vulnerable to directory traversals. The application does not restrict escape characters, allowing a malicious user to traverse the directories using a curl request such as http://localhost:8080/../../../../../../etc/passwd to gain sensitive information...

Cross-Site Scripting (XSS)

m-server is vulnerable to cross-site scripting XSS. It is possible for an attacker to embed an iframe containing malicious Javascript code via filenames. This is due to a lack of output encoding when the m-server displays content of the selected directory...

Node.js third-party modules: [m-server] Path Traversal allows to display content of arbitrary file(s) from the server

I would like to report Path Traversal in m-server module. It allows to read content of any arbitrary file from the server where m-server is installed and run. Module module name: m-server version: 1.4.0 npm page: https://www.npmjs.com/package/m-server Module Description M-Server is a mini http...

Node.js third-party modules: [m-server] HTML Injection in filenames displayed as directory listing in the browser allows to embed iframe with malicious JavaScript code

I would like to report Stored XSS vulnerability in m-server module. m-server displays content of selected directory as HTML in the browser. However, no escape is implemented which allows malicious user to embed executable JavaScript or HTML code eg. to load HTML document into iframe element and...