Executive brief
restify-swagger-jsdoc is a Node.js library that generates Swagger API documentation. The vulnerability allows attackers to access arbitrary files on the server by supplying specially crafted relative path URLs, bypassing the intended swagger-ui folder restriction. This could expose sensitive application files, configuration, or source code.
Technical details
The vulnerability is a path traversal (CWE-22) flaw caused by insufficient URL sanitization in the swagger-ui file serving logic. Attackers can use relative paths (e.g., `../../` sequences) in URLs to escape the designated swagger-ui directory and read arbitrary server files. The attack is network-accessible and requires no authentication or user interaction. An attacker can directly access the vulnerability by crafting malicious URLs to the affected endpoint. The flaw was fixed in version 3.2.1; users of versions prior to 3.2.1 should upgrade immediately.
Affected products
- restify-swagger-jsdoc restify-swagger-jsdoc < 3.2.1
Timeline
- 2020-09-03: disclosed