A vulnerability was found in serve-lite (version unknown). It has been classified as critical. Affected is the function path.join. The manipulation of the argument joinreq.url with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. CVE summarizes:

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join().

The weakness was published 01/27/2023. The advisory is available at gist.github.com. This vulnerability is traded as CVE-2022-21192 since 02/24/2022. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 01/27/2023). This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Name

• serve-lite

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion