GHSA-wm7q-rxch-43mx
Byass due to validation before canonicalization in serve
Quick fix
GHSA-wm7q-rxch-43mx — serve: upgrade to the fixed version with the command below.
npm install serve@6.5.2Details
Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames.
Example: Here we have a server that ignores the file test.txt. ``` const serve = require('serve') const server = serve(__dirname, { port: 1337, ignore: ['test.txt'] }) ```
Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file.
`curl http://localhost:1337/t%65st.txt`
Additionally this technique can be used to get directory listings of ignored directories.
## Recommendation
Update to version 6.5.2 or later.
Are you affected?
Enter the version of the package you're using.