High, CVSS 7.5npmAmendedPublished
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server
GHSA-3p34-w4f6-5xh2
- Affected
- npm better-helperjs <= 3.0.5
- Fixed in
- 3.0.6· Vendor fix available
- Issue
- A directory traversal vulnerability exists in the production static file server of better-helperjs (<= 3.0.5). Attackers can read arbitrary files located in adjacent directory structures that share the same string prefix as the intended static root directory. Details The framework utilizes a custom static file server engine used when running in NODEENV=production (src/ssr/site-server.ts). Inside the safeStaticPath() method, the requested path is checked against the static root directory to prevent directory traversal out of the designated public folder. However, the validation uses String.prototype.startsWith(): This is logically flawed because startsWith evaluates plain strings rather than structural directory paths. If the application's assigned rootDir is /app/dist/client, and an attacker tries to access /app/dist/client-secrets/database.sqlite, the string "/app/dist/client-secrets/database.sqlite" successfully starts with "/app/dist/client". Because of this bypass, an…
Recommended action: Upgrade to 3.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.