Application level denial of service due to shutting down the server

How it was found

Module

module name: http-live-simulator version: 1.0.7 npm page: https://www.npmjs.com/package/http-live-simulator

Description

I've found a way to crash the server due to the way it parses URL

Steps To Reproduce:

1- Install the module : npm install -g http-live-simulator 2- Run the server : http-live 3- Attempt to crash the server by this command curl --path-as-is http://localhost:8080/../?a

Explanation :

the reason for this issue is the fix for my previous report which is :

	var pathname = url.parse(req.url, true).pathname;
	while(pathname.indexOf("/../") != -1) {
		pathname = pathname.replace("/../",""); //fix for path traversal bug
	}

so now if we pass http://localhost:8080/../?a as the url the pathname becomes empty which will cause skipping this condition :

		if (pathname == "/") {
			for(var i=0;i<defaults.length;i++) {
				if (fs.existsSync(process.cwd() + '/' + defaults[i])) {
					pathname = '/' + defaults[i];
					break;
				}
			}
			if (pathname == '/') {
				return404(res, pathname);
				console.log(pathname);
				return;
			}
		}

with this in mind now we can proceed to the buggy snippet :

		abspath = process.cwd() + pathname;
		console.log('REQUEST: ', req.method, pathname);

		if (fs.existsSync(abspath)) {
			console.log("in condition");
			fs.readFile(abspath, function(err, data) {
				console.log("in condition1");
				var ext = pathname.slice(pathname.indexOf("."));
				var mtype = getMimeType(ext);
				res.writeHead(200, {'Content-Type': mtype});
				console.log(abspath, data);
				res.write(data);
				res.end();
			});
		}

here abspath becomes <project_dir> which cannot be read by readFile because it's a directory not a file causing the value of data to be undefined which will cause an error when trying to res.write(data); as res.write() function expects its parameter to be a string or buffer but it's undefined in this case.

Fix :

append a / to pathname if it becomes empty after sanitizing

Impact

Denial of service due to shutting down the server