Executive brief
node-git-server is a Node.js library that hosts Git repositories over HTTP. A path traversal vulnerability allows attackers to bypass intended repository directory restrictions by specifying absolute paths, enabling unauthorized access to any git repository on the system, including private ones.
Technical details
The vulnerability exists in versions prior to 0.6.1 and stems from improper use of path.resolve() in the repository directory mapping logic. When constructing repository paths, the code uses path.resolve(repoDir, dir), which prioritizes the second argument if it is an absolute path, allowing an attacker to completely override the intended repoDir prefix. An unauthenticated attacker on the network can exploit this by sending a git clone/push/pull request with an absolute path (e.g., git clone http://localhost:7005//etc/passwd) to access arbitrary git repositories. The fix (version 0.6.1+) replaces path.resolve() with path.join(), which safely concatenates paths without prioritizing absolute arguments.
Affected products
- node-git-server node-git-server 0.2.0 to 0.6.0
Timeline
- 2019-10-10: disclosed
- 2020-03-29: patched: Fix merged in pull request #62
- 2020-09-03: advisory: GHSA-cv3v-7846-6pxm published