CVE-2020-7684
📋 TL;DR
CVE-2020-7684 is a path traversal vulnerability in rollup-plugin-serve that allows attackers to read arbitrary files on the server due to lack of path sanitization. This affects all versions of the package when used in development servers. Developers using rollup-plugin-serve for local development are primarily affected.
💻 Affected Systems
- rollup-plugin-serve
📦 What is this software?
Rollup Plugin Serve by Rollup Plugin Serve Project
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system disclosure including sensitive configuration files, credentials, and source code.
Likely Case
Unauthorized reading of application files and configuration data from the development server.
If Mitigated
Limited impact if development server is isolated from production systems and sensitive data.
🎯 Exploit Status
Simple HTTP requests with path traversal sequences can exploit this vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.1.0 and later
Vendor Advisory: https://github.com/thgh/rollup-plugin-serve/security/advisories/GHSA-5r2p-5jf6-8j8h
Restart Required: Yes
Instructions:
1. Update package.json to use rollup-plugin-serve version 1.1.0 or higher. 2. Run 'npm update rollup-plugin-serve' or 'yarn upgrade rollup-plugin-serve'. 3. Restart your development server.
🔧 Temporary Workarounds
Disable development server
allStop using rollup-plugin-serve for development and use alternative development servers
npm uninstall rollup-plugin-serve
yarn remove rollup-plugin-serve
Network isolation
allEnsure development server only listens on localhost and is not exposed to network
Configure rollup-plugin-serve with host: 'localhost' in rollup.config.js
🧯 If You Can't Patch
- Ensure development server only runs on localhost interface (127.0.0.1)
- Implement network segmentation to isolate development environments from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check package.json for rollup-plugin-serve version below 1.1.0Check Version:
npm list rollup-plugin-serve | grep rollup-plugin-serveVerify Fix Applied:
Verify package.json shows rollup-plugin-serve version 1.1.0 or higher📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences or unusual file paths
- Failed file read attempts outside expected directories
Network Indicators:
- HTTP GET requests with path traversal sequences to development server port
SIEM Query:
source="web_server" AND (uri="*../*" OR uri="*..\\*" OR uri="*%2e%2e%2f*") AND dest_port="development_port"