Executive brief
restafary is a Node.js REST API file management service. When a root path is specified in the configuration, the service fails to properly validate file paths, allowing an authenticated attacker to use path traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files on the system, such as /etc/passwd.
Technical details
The vulnerability is a classic path traversal flaw (CWE-22) in restafary's file system API endpoint (/api/v1/fs/). When a root path is configured, the application does not properly neutralize path traversal characters in user-supplied file paths, allowing attackers to construct requests using URL-encoded sequences (e.g., ..%2f) to navigate outside the restricted directory. The attack requires HTTP authentication (via Basic Auth) and network access to the API. Successful exploitation allows an attacker to read arbitrary files accessible to the restafary process. The vulnerability has been patched in version 1.6.1 and later.
Affected products
- restafary restafary < 1.6.1
Timeline
- 2019-02-18: disclosed