Executive brief
socket.io-file is a Node.js library that handles file uploads over WebSocket connections. The library fails to properly validate file paths, allowing an attacker to upload files to arbitrary locations on the server by using path traversal sequences (e.g., ../../). This could enable an attacker to overwrite critical system files or deploy malicious code to the application server.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in socket.io-file's file upload functionality. When handling the createFile message, the library passes the user-supplied "name" parameter directly to path.join() without sanitization, allowing sequences like ../ to traverse outside the intended upload directory. An unauthenticated attacker can exploit this via the network to craft malicious file upload requests. The vulnerability affects all versions up to and including 2.0.31, with no patched version released as of the advisory date. An attacker can write files to any location on the filesystem where the Node.js process has write permissions.
Affected products
- Rico socket.io-file <=2.0.31
Timeline
- 2020-07-07: disclosed