CVE-2021-23430
📋 TL;DR
CVE-2021-23430 is a directory traversal vulnerability in the startserver npm package that allows attackers to read arbitrary files outside the intended directory. All versions of startserver are affected. This impacts any application using this package as a development server.
💻 Affected Systems
- startserver npm package
📦 What is this software?
Startserver by Startserver Project
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files like configuration files, credentials, or source code, potentially leading to complete system compromise.
Likely Case
Unauthorized file disclosure of application files, configuration data, or other sensitive information accessible to the server process.
If Mitigated
Limited impact if proper file permissions restrict server process access to sensitive directories.
🎯 Exploit Status
Directory traversal vulnerabilities are well-understood and easy to exploit with simple HTTP requests containing path traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None - package is deprecated
Vendor Advisory: https://github.com/xudafeng/startserver/security/advisories
Restart Required: Yes
Instructions:
1. Remove startserver from your project dependencies. 2. Use an alternative development server like webpack-dev-server, vite, or express with proper security controls. 3. Update package.json and reinstall dependencies.
🔧 Temporary Workarounds
Replace with secure alternative
allReplace startserver with a maintained development server that has proper path sanitization
npm uninstall startserver
npm install --save-dev webpack-dev-server
Implement middleware validation
allAdd middleware to validate and sanitize file paths before processing
// Add express middleware example: app.use((req, res, next) => { const path = req.path; if (path.includes('..')) { return res.status(400).send('Invalid path'); } next(); })
🧯 If You Can't Patch
- Run startserver with minimal file system permissions using a dedicated low-privilege user account
- Deploy behind a reverse proxy with strict path validation and WAF rules blocking directory traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check if startserver is in your package.json dependencies or run: npm list startserverCheck Version:
npm list startserverVerify Fix Applied:
Verify startserver is no longer in package.json and test that file requests with ../ sequences return errors📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ or ..\ sequences
- File access errors for paths outside expected directories
- Unusual file read patterns from server process
Network Indicators:
- HTTP requests with encoded directory traversal sequences (%2e%2e%2f, ..%2f)
- Responses containing file contents that shouldn't be accessible
SIEM Query:
source="web_server" AND (uri="*../*" OR uri="*..\\*" OR uri="*%2e%2e%2f*")🔗 References
- https://github.com/xudafeng/startserver/blob/bef0c4e4d21da42a40ce87cf25fd54ac8d8cb2d8/lib/index.js%23L71
- https://snyk.io/vuln/SNYK-JS-STARTSERVER-1296388
- https://github.com/xudafeng/startserver/blob/bef0c4e4d21da42a40ce87cf25fd54ac8d8cb2d8/lib/index.js%23L71
- https://snyk.io/vuln/SNYK-JS-STARTSERVER-1296388
