better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

Summary

A directory traversal vulnerability exists in the production static file server of better-helperjs (<= 3.0.5). Attackers can read arbitrary files located in adjacent directory structures that share the same string prefix as the intended static root directory.

Details

The framework utilizes a custom static file server engine used when running in NODE_ENV=production (src/ssr/site-server.ts). Inside the safeStaticPath() method, the requested path is checked against the static root directory to prevent directory traversal out of the designated public folder.

However, the validation uses String.prototype.startsWith():

  const root = path.resolve(rootDir);
  const resolved = path.resolve(root, `.${decodedPath}`);
  
  if (!resolved.startsWith(root)) {
    return null;
  }

This is logically flawed because startsWith evaluates plain strings rather than structural directory paths. If the application's assigned rootDir is /app/dist/client, and an attacker tries to access /app/dist/client-secrets/database.sqlite, the string "/app/dist/client-secrets/database.sqlite" successfully starts with "/app/dist/client".

Because of this bypass, an attacker can read sensitive files stored inside any adjacent directory traversing through the parent, as long as the adjacent directory name begins with the exact same prefix as the target public directory.

Impact

• Severity: High (7.5)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Affected Versions: <= 3.0.5
• Patched Version: >= 3.0.6

Proof of Concept

To reproduce this locally on a vulnerable installation:

1. Assume the framework static configuration serves from a .dist/client directory.
2. Build the project and create an adjacent prefix secret simulating sensitive deployment structure: