Platform
nodejs
Component
serve
Fixed in
7.0.1
7.0.0
CVE-2019-5415 describes a Path Traversal vulnerability affecting the serve package. This flaw allows attackers to bypass folder exclusion rules by manipulating file paths with sequences like /./, potentially exposing sensitive files and directories. The vulnerability impacts versions of serve prior to 7.0.1, and a fix is available in version 7.0.1.
The primary impact of CVE-2019-5415 is unauthorized access to files and directories that should be protected. An attacker could exploit this vulnerability to retrieve configuration files, source code, or other sensitive data from the server hosting the serve application. This could lead to information disclosure, and in some cases, could be a stepping stone for further attacks, such as code execution if the retrieved files contain exploitable code. The blast radius depends on the sensitivity of the files accessible through the server; a development server with source code would have a higher impact than a static website serving only public content.
CVE-2019-5415 was publicly disclosed on March 25, 2019. There is no indication of active exploitation campaigns targeting this vulnerability. No public proof-of-concept exploits are widely known, but the simplicity of the path traversal technique makes it likely that such exploits could be developed. It is not listed on the CISA KEV catalog.
Exploit Status
EPSS
0.32% (55% percentile)
CVSS Vector
The recommended mitigation for CVE-2019-5415 is to upgrade to version 7.0.1 or later of the serve package. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing the /./ sequence in the path. Additionally, review and restrict file permissions on the server to minimize the potential damage from unauthorized access. After upgrading, confirm the fix by attempting to access a previously protected directory using a path containing /./ – access should be denied.
Upgrade the version of `serve` to 7.0.1 or later. This will correct the vulnerability in the handling of ignored files and directories, preventing an attacker from accessing unauthorized resources.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2019-5415 is a vulnerability in the serve package that allows attackers to bypass folder exclusion rules by using /./ in the path, potentially accessing sensitive files.
You are affected if you are using a version of serve prior to 7.0.1. Check your installed version with npm list serve.
Upgrade to version 7.0.1 or later of the serve package using npm install serve@latest.
There is no public evidence of active exploitation, but the vulnerability's simplicity makes it a potential target.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.