node-git-server unauthorized file access via absolute paths

Executive brief

node-git-server is a library used to create and manage Git servers in Node.js environments. A security flaw allows unauthorized users to access private Git repositories by using specific file path techniques. This could lead to the exposure of sensitive source code and intellectual property stored on the server.

Technical details

node-git-server prior to version 0.6.1 is vulnerable to CWE-552 (Files or Directories Accessible to External Parties). The vulnerability exists because the server does not properly validate or sanitize repository paths, allowing an attacker to use absolute paths to access any Git repository on the filesystem that the process has permissions to read. This is a network-reachable vulnerability that requires no authentication or user interaction. Attackers can exploit this to clone or read private repositories. The issue is resolved in version 0.6.1.

Affected products

• gabrielcsapo node-git-server >= 0.2.0, < 0.6.1

Timeline

• 2020-08-31: advisory: GitHub reviewed the advisory
• 2020-09-03: disclosed: Advisory published to GitHub Advisory Database
• 2020-09-03: patched: Version 0.6.1 released

References

• https://api.github.com/users/RainSignal
• https://github.com/RainSignal
• https://api.github.com/users/RainSignal/gists%7B/gist_id%7D
• https://api.github.com/users/RainSignal/repos
• https://avatars.githubusercontent.com/u/101503193?v=4
• https://api.github.com/users/RainSignal/events%7B/privacy%7D