CVE-2019-5415：serve 7.0.1之前版本存在路径遍历漏洞

CVE-2019-5415 在 serve 中允许攻击者通过路径操作访问隐藏或未授权的文件和目录。7.0.1 之前的 serve 版本容易受到此路径遍历问题的影响。具体来说，在请求的路径中使用 /./ 序列可以绕过定义的文件夹排除规则，从而允许访问通常应受保护的敏感内容。这可能包括配置文件、源代码或机密数据，从而损害使用 serve 的应用程序或服务器的安全性。CVSS 严重性评分为 7.5，表明存在高风险。

Development teams using serve to serve static files during development are particularly at risk. Shared hosting environments where users have limited control over their server configuration are also vulnerable if the serve package is installed and not properly updated. Projects relying on older versions of serve in automated build pipelines are also exposed.

• nodejs / server:

  npm list serve

Check the version of serve installed in your project. If it's less than 7.0.1, you are vulnerable. • generic web: curl -I <yourserveurl>/../../../../etc/passwd Attempt to access sensitive files using path traversal. A successful response indicates a vulnerability.

1. 2019-03-25Disclosure

   disclosure

1. 已保留2019-01-04
2. 发布日期2019-03-25
3. 修改日期2025-07-15
4. EPSS 更新日期2026-04-02

减轻此漏洞的建议解决方案是升级到 serve 的 7.0.1 或更高版本。此版本通过正确处理包含 /./ 序列的路径来修复路径遍历问题。在升级之前，请务必备份当前的配置。此外，请审查应用程序的安全策略，以确保已采取额外的保护措施以防止对文件和目录的未经授权的访问。升级是保护自己免受此漏洞影响并维护数据完整性的最有效方法。