| शीर्षक | Restify Project node-restify 11.1.0 Path Traversal |
|---|
| विवरण | Path Traversal in restify (node-restify) serveStatic via broken directory containment regex. Confirmed on restify 11.1.0; related to open issue #1910 (unfixed).
restify.plugins.serveStatic builds a containment check as:
new RegExp('^' + escapeRE(normalizedDirectory) + '/?.*')
This regex lacks a proper path-separator boundary. Sibling directories whose names extend the configured root prefix (e.g. /tmp/rs-root-evil vs /tmp/rs-root) pass the check. Combined with:
path.join(opts.directory, decodeURIComponent(req.path()))
request paths containing ../ escape the intended static root and cause arbitrary files outside the configured directory to be served.
Common mount pattern:
server.get('/static/*', restify.plugins.serveStatic({ directory: './public' }))
Impact: unauthenticated arbitrary file read outside the static directory (confidentiality). CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Related prior report: https://github.com/restify/node-restify/issues/1910
Vendor disclosure channel discussion: https://github.com/restify/node-restify/issues/1989
Suggested fix: validate path.resolve(file).startsWith(path.resolve(directory) + path.sep), or use serveStaticFiles (send-based). |
|---|
| उपयोगकर्ता | ciphersecuritylabs (UID 99852) |
|---|
| सबमिशन | 16/07/2026 11:32 AM (2 महीनों पहले) |
|---|
| संयम | 12/09/2026 10:16 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403082 [restify node-restify तक 12.0.0 /lib/plugins/static.js serveStatic निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 17 |
|---|