Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 9 October 2018.

Which products and versions are affected?

Send SEMVER:introduced=0,fixed=0.8.4.

Is there a fix for This vulnerability?

Yes. Send: upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Send at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

visionmedia send path traversal vulnerability

Severity: info · Published 2018-10-09

The visionmedia send library is a Node.js utility for serving files over HTTP. A flaw in its directory validation logic allows attackers to access restricted directories outside the intended document root by exploiting partial string matching (e.g., accessing "public-restricted" when "public" should be the boundary). This could expose sensitive files to unauthorized access.

Technologies: Send.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 9 October 2018.
Which products and versions are affected?: Send SEMVER:introduced=0,fixed=0.8.4.
Is there a fix for This vulnerability?: Yes. Send: upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Send at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Send: upgrade to 0.8.4 or later

Technical details

The vulnerability is a path traversal issue in visionmedia send versions before 0.8.4, stemming from incomplete directory boundary validation logic. The library uses a partial comparison rather than strict path validation when checking whether a requested directory lies within the configured document root. An unauthenticated remote attacker can bypass this check over the network by crafting requests targeting directories with names that share a common prefix (e.g., "public-restricted" bypasses a check for "public" as root). The attacker achieves unauthorized file access to restricted directories. The vulnerability was patched in version 0.8.4.

Affected products

visionmedia send before 0.8.4

Timeline

2018-10-09: disclosed
2018-10-09: patched: Fixed in version 0.8.4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.