GHSA-48gc-5j93-5cfq Path Traversal in serve
Attackers can access hidden folders and files via relative paths in the serve static file server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-48gc-5j93-5cfq?
GHSA-48gc-5j93-5cfq is a path traversal vulnerability in serve, published on 11 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files.
Recommendation
Upgrade to version 10.1.2 or later.
Which versions are affected by GHSA-48gc-5j93-5cfq?
2 open source packages ship an affected version, including serve.
| Package | Affected | Fixed in |
|---|---|---|
serve npm | All versions | 10.1.2 |
serve npm | All versions | 10.1.2 |
How do I fix GHSA-48gc-5j93-5cfq?
Upgrade serve to 10.1.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-48gc-5j93-5cfq being exploited?
There is no known exploitation of GHSA-48gc-5j93-5cfq in the wild and no public exploit code.