GHSA-wm7q-rxch-43mx: 
JavaScript vulnerability analysis and mitigation

A high severity vulnerability was identified in the 'serve' npm package affecting versions prior to 6.5.2. The vulnerability, tracked as GHSA-wm7q-rxch-43mx, was discovered and published to the GitHub Advisory Database on September 1, 2020, with the latest update on January 9, 2023. The issue allows for bypassing the ignore functionality in the serve package (GitHub Advisory).

The vulnerability stems from a validation flaw where path and filename validation occurs before canonicalization. This sequence allows attackers to bypass ignore controls by using URL-encoded characters. For example, if a server is configured to ignore 'test.txt', an attacker can still access the file by using URL encoding (e.g., using %65 instead of 'e' in the filename). This technique can also be exploited to obtain directory listings of ignored directories (GitHub Advisory).

The vulnerability enables attackers to bypass intended access restrictions and access files or directories that were explicitly configured to be ignored by the serve package. This could potentially lead to unauthorized access to sensitive files and directory information that should have been protected (GitHub Advisory).

The vulnerability can be exploited by making HTTP requests with URL-encoded characters in the file or directory names. A proof of concept demonstrates that sending a request to 'http://localhost:1337/t%65st.txt' would bypass the ignore rule for 'test.txt' (GitHub Advisory).

Users are recommended to update to serve version 6.5.2 or later, which contains the fix for this vulnerability (GitHub Advisory).