Executive brief
The visionmedia send library is a Node.js utility for serving files over HTTP. A flaw in its directory validation logic allows attackers to access restricted directories outside the intended document root by exploiting partial string matching (e.g., accessing "public-restricted" when "public" should be the boundary). This could expose sensitive files to unauthorized access.
Technical details
The vulnerability is a path traversal issue in visionmedia send versions before 0.8.4, stemming from incomplete directory boundary validation logic. The library uses a partial comparison rather than strict path validation when checking whether a requested directory lies within the configured document root. An unauthenticated remote attacker can bypass this check over the network by crafting requests targeting directories with names that share a common prefix (e.g., "public-restricted" bypasses a check for "public" as root). The attacker achieves unauthorized file access to restricted directories. The vulnerability was patched in version 0.8.4.
Affected products
- visionmedia send before 0.8.4
Timeline
- 2018-10-09: disclosed
- 2018-10-09: patched: Fixed in version 0.8.4