GHSA-wm7q-rxch-43mx

Source

https://github.com/advisories/GHSA-wm7q-rxch-43mx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-wm7q-rxch-43mx/GHSA-wm7q-rxch-43mx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wm7q-rxch-43mx

Published

2020-09-01T19:38:33Z

Modified

2020-08-31T18:29:10Z

Summary

Byass due to validation before canonicalization in serve

Details

Versions of serve before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames.

Example: Here we have a server that ignores the file test.txt.

const serve = require('serve')
const server = serve(__dirname, {
      port: 1337,
      ignore: ['test.txt']
})

Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file.

curl http://localhost:1337/t%65st.txt

Additionally this technique can be used to get directory listings of ignored directories.

Recommendation

Update to version 6.5.2 or later.

Database specific

{
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:29:10Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

npm / serve

Package

Name: serve; View open source insights on deps.dev
Purl: pkg:npm/serve

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.5.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-wm7q-rxch-43mx/GHSA-wm7q-rxch-43mx.json"