Executive brief
Oak is a Deno-based web framework used to serve files from a directory. A path traversal vulnerability allows attackers to bypass the built-in protection against accessing hidden files (like .env or .git directories) by using URL-encoded slashes in requests. An attacker can read sensitive configuration files and server secrets without authentication.
Technical details
Oak's Context.send API is intended to prevent serving hidden files (those starting with a dot) from the configured root directory. However, the vulnerability stems from two flaws: (1) the use of decodeComponent on incoming request paths, which decodes %2F into forward slashes, allowing path traversal sequences like poc%2f../ to bypass validation, and (2) the isHidden check only validates the first path component, missing hidden files in subdirectories (e.g., subdir/.env). An unauthenticated remote attacker can craft requests with URL-encoded slashes to read arbitrary hidden files within the served root directory, such as .env or .git/config, exposing sensitive credentials and secrets. Patched versions: Oak 17.1.3 (jsr.io), no patch released for @oakserver/oak on npm as of advisory date.
Affected products
- Oak Oak <=17.1.2
Timeline
- 2024-11-01: disclosed: Vulnerability published as GHSA-qm92-93fv-vh7m and CVE-2024-49770
- 2024-11-01: patched: Oak 17.1.3 released with fix