Rabbithole

vercel/serve allows access to restricted files if filename is URL encoded.

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

Cross-Site Scripting in serve

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. ## Recommendation Upgrade to version 10.0.2 or later.

Cross-Site Scripting in serve

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. ## Recommendation Upgrade to version 10.0.2 or later.

Path Traversal in serve

Versions of `serve` prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. ## Recommendation Upgrade to version 10.1.2 or later.

Byass due to validation before canonicalization in serve

Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames. Example: Here we have a server that ignores the file test.txt. ``` const serve = require('serve') const server = serve(__dirname, { port: 1337, ignore: ['test.txt'] }) ``` Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file. `cur