CVE-2016-10528: Directory Traversal in restafary
Summary
CVE-2016-10528: Directory Traversal in restafary. Affects restafary versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The restafary package is an npm package that provides a RESTful API for managing files and directories. It allows users to perform various file operations such as uploading, downloading, and deleting files. The package is vulnerable to a directory traversal vulnerability when a root path is specified in the configuration.
Vulnerability Detail
The directory traversal vulnerability in restafary allows an attacker to access files outside of the intended directory. By manipulating the path parameter in a specific way, an attacker can traverse the file system and access sensitive files, such as the /etc/passwd file. This can lead to unauthorized access, information disclosure, and potential compromise of the system.
How To Fix
Minimum fixed version
1.6.1
This is the first release that contains the fix.
npm install restafary@1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the latest version is the best solution.
Conclusion
The restafary package is vulnerable to a directory traversal vulnerability that allows unauthorized access to sensitive files. To mitigate this vulnerability, it is crucial to update to version 1.6.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for restafary →
FAQ
This vulnerability allows an attacker to access sensitive files on the system, potentially leading to unauthorized access and information disclosure.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and it will analyze and alert you in real-time.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to update to the latest version to mitigate the risk.
Yes, updating to version 1.6.1 or later of the restafary package fixes this vulnerability.
No, updating to the latest version is the recommended solution to mitigate the risk associated with this vulnerability.
