| Titre | Restify Project node-restify 11.1.0 Path Traversal |
|---|
| Description | Path Traversal in restify (node-restify) serveStatic via broken directory containment regex. Confirmed on restify 11.1.0; related to open issue #1910 (unfixed).
restify.plugins.serveStatic builds a containment check as:
new RegExp('^' + escapeRE(normalizedDirectory) + '/?.*')
This regex lacks a proper path-separator boundary. Sibling directories whose names extend the configured root prefix (e.g. /tmp/rs-root-evil vs /tmp/rs-root) pass the check. Combined with:
path.join(opts.directory, decodeURIComponent(req.path()))
request paths containing ../ escape the intended static root and cause arbitrary files outside the configured directory to be served.
Common mount pattern:
server.get('/static/*', restify.plugins.serveStatic({ directory: './public' }))
Impact: unauthenticated arbitrary file read outside the static directory (confidentiality). CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Related prior report: https://github.com/restify/node-restify/issues/1910
Vendor disclosure channel discussion: https://github.com/restify/node-restify/issues/1989
Suggested fix: validate path.resolve(file).startsWith(path.resolve(directory) + path.sep), or use serveStaticFiles (send-based). |
|---|
| Utilisateur | ciphersecuritylabs (UID 99852) |
|---|
| Soumission | 16/07/2026 11:32 (il y a 2 mois) |
|---|
| Modérer | 12/09/2026 10:16 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 403082 [restify node-restify jusqu’à 12.0.0 /lib/plugins/static.js serveStatic directory traversal] |
|---|
| Points | 17 |
|---|