Executive brief
The resolve-path library is used to safely resolve relative file paths in Node.js applications. Versions before 1.4.0 fail to properly sanitize Windows file paths, allowing an attacker to use specially-crafted path sequences to escape the intended directory and access arbitrary files on the system. This could lead to unauthorized disclosure of sensitive files or system information.
Technical details
resolve-path before version 1.4.0 suffers from path traversal (CWE-22) due to inadequate sanitization of Windows-style file paths in the relative path resolving logic. The vulnerability allows an attacker to construct malicious path strings using special characters that bypass the intended directory restrictions. Attack vectors include any application accepting user-controlled path inputs and using resolve-path to validate them; no authentication or user interaction is required. An attacker can achieve unauthorized information disclosure by reading arbitrary files accessible to the process. The vulnerability was patched in version 1.4.0, which implements proper path normalization and sanitization. Fix commit: fe5b8052cafd35fcdafe9210e100e9050b37d2a0.
Affected products
- pillarjs resolve-path < 1.4.0
Timeline
- 2018-06-07: disclosed: Published to National Vulnerability Database
- 2018-07-18: advisory: Published to GitHub Advisory Database as GHSA-62g9-6hw5-rwfp
- 2018-07-18: patched: Fix released in version 1.4.0