Executive brief
send is a Node.js library used to serve files over HTTP with directory restriction capabilities. The library contains a directory traversal vulnerability in its root option that allows attackers to access files outside the intended restricted directory by exploiting a path comparison flaw, potentially exposing sensitive files like configuration data or application code.
Technical details
The vulnerability is a directory traversal flaw (CWE-22) in the send library versions 0.8.3 and earlier. The root cause is an insecure path comparison that fails to properly validate directory boundaries; an attacker can escape the restricted directory by accessing similarly-named directories (e.g., requesting access to `/public-restricted` when the root is set to `/public`). The vulnerability requires network access to a web application using send with a restrictive root option, but no authentication is required. An attacker can read arbitrary files from the filesystem that are accessible to the application process. The vulnerability was patched in version 0.8.4 and later.
Affected products
- TJ Holowaychuk send 0.8.3 and earlier
Timeline
- 2014-09: disclosed: Vulnerability reported on openwall OSS-security mailing list
- 2014: patched: Fixed in version 0.8.4
- 2017-10-24: advisory: GHSA-xwg4-93c6-3h42 published