BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.

Affected: npm: browserstack-runner

## Summary

The HTTP server in browserstack-runner serves files from the project directory via the `_default` handler. This handler uses `path.join(process.cwd(), uri)` to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on `0.0.0.0` (all interfaces) and the absence of any authentication, this allows an unauthenticated network-adjacent attacker to read arbitrary files from the host filesystem.

## Root Cause

**lib/server.js, lines 530–534 : `_default` handler:**

```javascript '_default': function defaultHandler(uri, body, request, response) { var filePath = path.join(process.cwd(), uri); handleFile(filePath, request, response); } ```

`uri` comes from `url.parse(request.url).pathname` (line 540), which preserves `../` sequences. `path.join` resolves them, producing absolute paths outside the project directory. No boundary check is performed before serving the file.

**bin/cli.js, line 131 : server binding:**

```javascript server.listen(parseInt(config.test_server_port, 10)); ```

No hostname is specified, so Node.js binds on `0.0.0.0` (all interfaces).

**No authentication:** The `_default` handler does not call `getWorkerUuid()` or perform any authentication check.

## Steps to Reproduce

### Step 1 : Start the server (Terminal 1)

```bash cd browserstack-runner echo '<html><body>test</body></html>' > _poc_test.html echo '{"username":"X","key":"X","test_path":"_poc_test.html","test_fr…