| 标题 | Restify Project node-restify 11.1.0 Path Traversal |
|---|
| 描述 | Path Traversal in restify (node-restify) serveStatic via broken directory containment regex. Confirmed on restify 11.1.0; related to open issue #1910 (unfixed).
restify.plugins.serveStatic builds a containment check as:
new RegExp('^' + escapeRE(normalizedDirectory) + '/?.*')
This regex lacks a proper path-separator boundary. Sibling directories whose names extend the configured root prefix (e.g. /tmp/rs-root-evil vs /tmp/rs-root) pass the check. Combined with:
path.join(opts.directory, decodeURIComponent(req.path()))
request paths containing ../ escape the intended static root and cause arbitrary files outside the configured directory to be served.
Common mount pattern:
server.get('/static/*', restify.plugins.serveStatic({ directory: './public' }))
Impact: unauthenticated arbitrary file read outside the static directory (confidentiality). CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Related prior report: https://github.com/restify/node-restify/issues/1910
Vendor disclosure channel discussion: https://github.com/restify/node-restify/issues/1989
Suggested fix: validate path.resolve(file).startsWith(path.resolve(directory) + path.sep), or use serveStaticFiles (send-based). |
|---|
| 用户 | ciphersecuritylabs (UID 99852) |
|---|
| 提交 | 2026-07-16 11時32分 (2 月前) |
|---|
| 管理 | 2026-09-12 10時16分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 403082 [restify node-restify 直到 12.0.0 /lib/plugins/static.js serveStatic 目录遍历] |
|---|
| 积分 | 17 |
|---|