Executive brief
Geddy is a web application framework for Node.js. A security flaw in how it handles file requests allows unauthorized users to access sensitive files on the server's operating system, such as configuration files or password databases. This could lead to the exposure of private system information and credentials.
Technical details
A directory traversal vulnerability exists in the static file serving component of Geddy (specifically lib/app/index.js) for versions prior to 13.0.8. The application fails to properly sanitize URI-encoded 'dot-dot-slash' (%2f..%2f) sequences in the PATH_INFO of a request. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP request to traverse outside of the intended public directory and read sensitive files on the underlying filesystem, such as /etc/passwd. The issue was addressed in version 13.0.8 by improving path validation.
Affected products
- geddyjs geddy < 13.0.8
Timeline
- 2015-07-27: disclosed: Issue reported on GitHub
- 2015-07-27: patched: Fix merged and version 13.0.8 released
- 2015-09-04: advisory: NVD published CVE-2015-5688