esbuild allows arbitrary file read when running the development server on Windows

Description

The development server contains a path traversal vulnerability on Windows when serving files from servedir.

Due to the use of path.Clean() (which only normalizes forward-slash / separators) instead of a Windows-aware path normalization function, it is possible to craft requests using backslashes (\) that bypass the intended directory containment logic.

Recommendation

Update the esbuild package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.27.3, < 0.28.1
• Patched version(s): 0.28.1

References

• GHSA-g7r4-m6w7-qqqr
• CWE-22
• OWASP 2021-A1

Related Issues

• @saltcorn/server arbitrary file zip read and download when downloading auto backups - Vulnerability
• esbuild enables any website to send any requests to the development server and read the response - Vulnerability
• webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle - CVE-2024-43373
• @saltcorn/server arbitrary file and directory listing when accessing build mobile app results - Vulnerability

You might also like:

Secure Coding 101: How to Read and Write Files Securely

10 Secure Coding Best Practices to Follow in Every Project

Exploiting Server Version Disclosure

Tags:

npm

esbuild