CyberRota Analysis
AI-GeneratedThe @hapi/inert package, used for serving static files in hapi.js applications, is vulnerable to directory traversal attacks in versions 4.0.0 to 7.1.0, allowing unauthenticated remote attackers to access sensitive files outside the intended directory. This vulnerability arises from an inadequate confinement check that improperly accepts paths from sibling directories. Developers using affected versions should prioritize upgrading to version 7.1.1 to mitigate the risk of unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.