Quick answers
- Is CVE-2014-6394 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2014-6394 being exploited in the wild.
- How severe is CVE-2014-6394?
- Informational severity, published 24 October 2017.
- Which products and versions are affected?
- Send SEMVER:introduced=0,fixed=0.8.4.
- Is there a fix for CVE-2014-6394?
- Yes. Send: upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2014-6394 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2014-6394?
- Check whether you run Send at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Send: upgrade to 0.8.4 or later
Technical details
The vulnerability is a directory traversal flaw (CWE-22) in the send library versions 0.8.3 and earlier. The root cause is an insecure path comparison that fails to properly validate directory boundaries; an attacker can escape the restricted directory by accessing similarly-named directories (e.g., requesting access to `/public-restricted` when the root is set to `/public`). The vulnerability requires network access to a web application using send with a restrictive root option, but no authentication is required. An attacker can read arbitrary files from the filesystem that are accessible to the application process. The vulnerability was patched in version 0.8.4 and later.
Affected products
- TJ Holowaychuk send 0.8.3 and earlier
Identifiers
- CVE-2014-6394
- GHSA-xwg4-93c6-3h42
Timeline
- 2014-09: disclosed: Vulnerability reported on openwall OSS-security mailing list
- 2014: patched: Fixed in version 0.8.4
- 2017-10-24: advisory: GHSA-xwg4-93c6-3h42 published