VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 7, 2019· Updated Aug 5, 2024

CVE-2018-11798

CVE-2018-11798

Description

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Thrift Node.js static web server 0.9.2-0.11.0 allows remote file access outside the docroot due to improper path sanitization.

Vulnerability

The Apache Thrift Node.js static web server, versions 0.9.2 through 0.11.0, contains a path traversal vulnerability in the file serving functionality. The server fails to properly sanitize file paths, allowing requests to escape the configured document root directory. This affects the TWebServer or similar component used for serving static files. [1][3][4]

Exploitation

An unauthenticated remote attacker can send HTTP requests with crafted path sequences (e.g., ../) to traverse directories outside the intended web root. No special privileges or user interaction is required; the attacker only needs network access to the vulnerable server. [1][4]

Impact

Successful exploitation allows the attacker to read arbitrary files from the server's filesystem that are accessible to the Thrift process. This can lead to disclosure of sensitive information such as configuration files, source code, or other data. The confidentiality of the system is compromised. [2][3]

Mitigation

The vulnerability is fixed in Apache Thrift version 0.12.0. Users should upgrade to 0.12.0 or later. For Red Hat JBoss Data Virtualization, the fix is included in version 6.4.8 (RHSA-2019:3140). No workarounds are documented; upgrading is the recommended action. [1][2][4]

References
  1. Thrift-4647: Node.js Filesever webroot fixed path by jfarrell · Pull Request #1606 · apache/thrift
  2. https://access.redhat.com/errata/RHSA-2019:3140
  3. NVD - CVE-2018-11798
  4. [THRIFT-4647] [CVE-2018-11798] Node.js Fileserver webroot path

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.thrift:libthriftMaven
>= 0.9.2, < 0.12.00.12.0

Affected products

136

Patches

1
2a2b72f6c8ae

Thrift-4647: Node.js Filesever webroot fixed path

https://github.com/apache/thriftjfarrellOct 5, 2018via ghsa
commit
3 files changed · +11 −3
  • lib/js/test/server_http.js+1 −1 modified
    @@ -42,7 +42,7 @@ const ThriftTestSvcOpt = {
 };
 
 const ThriftWebServerOptions = {
-	files: '.',
+	files: __dirname,
 	services: {
 		'/service': ThriftTestSvcOpt
 	}
  • lib/js/test/server_https.js+1 −1 modified
    @@ -42,7 +42,7 @@ const ThriftTestSvcOpt = {
 };
 
 const ThriftWebServerOptions = {
-  files: '.',
+  files: __dirname,
   tls: {
      key: fs.readFileSync('../../../test/keys/server.key'),
      cert: fs.readFileSync('../../../test/keys/server.crt')
  • lib/nodejs/lib/thrift/web_server.js+9 −1 modified
    @@ -415,7 +415,15 @@ exports.createWebServer = function(options) {
 
     //Locate the file requested and send it
     var uri = url.parse(request.url).pathname;
-    var filename = path.join(baseDir, uri);
+    var filename = path.resolve(path.join(baseDir, uri));
+
+    //Ensure the basedir path is not able to be escaped
+    if (filename.indexOf(baseDir) != 0) {
+      response.writeHead(400, "Invalid request path", {});
+      response.end();
+      return;
+    }
+
     fs.exists(filename, function(exists) {
       if(!exists) {
         response.writeHead(404);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.