| 제목 | Restify Project node-restify 11.1.0 Path Traversal |
|---|
| 설명 | Path Traversal in restify (node-restify) serveStatic via broken directory containment regex. Confirmed on restify 11.1.0; related to open issue #1910 (unfixed).
restify.plugins.serveStatic builds a containment check as:
new RegExp('^' + escapeRE(normalizedDirectory) + '/?.*')
This regex lacks a proper path-separator boundary. Sibling directories whose names extend the configured root prefix (e.g. /tmp/rs-root-evil vs /tmp/rs-root) pass the check. Combined with:
path.join(opts.directory, decodeURIComponent(req.path()))
request paths containing ../ escape the intended static root and cause arbitrary files outside the configured directory to be served.
Common mount pattern:
server.get('/static/*', restify.plugins.serveStatic({ directory: './public' }))
Impact: unauthenticated arbitrary file read outside the static directory (confidentiality). CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Related prior report: https://github.com/restify/node-restify/issues/1910
Vendor disclosure channel discussion: https://github.com/restify/node-restify/issues/1989
Suggested fix: validate path.resolve(file).startsWith(path.resolve(directory) + path.sep), or use serveStaticFiles (send-based). |
|---|
| 사용자 | ciphersecuritylabs (UID 99852) |
|---|
| 제출 | 2026. 07. 16. AM 11:32 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 12. AM 10:16 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 403082 [restify node-restify 까지 12.0.0 /lib/plugins/static.js serveStatic 디렉토리 순회] |
|---|
| 포인트들 | 17 |
|---|