Description

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

Remediation

References

https://gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9

https://github.com/cunjieliu/easyServer/blob/master/index.js%23L27

https://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539

Related Vulnerabilities

CVE-2023-38509 Vulnerability in maven package org.xwiki.platform:xwiki-platform-livetable-ui

CVE-2021-32730 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui

CVE-2023-35166 Vulnerability in maven package org.xwiki.platform:xwiki-platform-help-ui

CVE-2021-3810 Vulnerability in npm package code-server

CVE-2017-11554 Vulnerability in npm package node-sass

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory Broken Link