CVE-2022-21192: 
JavaScript vulnerability analysis and mitigation

CVE-2022-21192 affects all versions of the serve-lite package, which is a lightweight HTTP server for static file-based web development. The vulnerability was discovered by Liran Tal and disclosed on November 28, 2022. The issue was published in the National Vulnerability Database on January 24, 2023. This vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) (Snyk).

The vulnerability is classified as a Directory Traversal (CWE-22) due to missing input sanitization on the req.url parameter that is passed directly to path.join(). The vulnerability exists in the server's request handling code where the URL is decoded and processed without proper validation. The attack vector is network-accessible with low attack complexity, requiring no privileges or user interaction (GitHub POC).

When successfully exploited, this vulnerability allows attackers to access files and directories stored outside the intended folder through path traversal techniques. This can result in unauthorized access to sensitive files and potential exposure of critical system information (Snyk).

The vulnerability is easily exploitable through HTTP requests using path traversal sequences. A proof of concept exploit has been published demonstrating how an attacker can access files outside the static directory using curl commands with specially crafted paths (GitHub POC).

The vulnerability has been fixed in serve-lite version 1.1.1. Users should upgrade to this version or higher to address the security issue. The fix was implemented through a patching commit in the serve-lite repository (GitHub POC).

The researcher noted that the package had "virtually zero downloads, so no considerable impact." The maintainer acknowledged the vulnerability report and promptly released a fix (GitHub POC).