CVE-2020-7687: Directory Traversal in fast-http
Summary
CVE-2020-7687: Directory traversal in fast-http. Affects fast-http versions < 0.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-http is an npm package that provides functionality for handling HTTP requests and responses in a fast and efficient manner. It is widely used in web applications to improve performance. However, all versions of fast-http are vulnerable to a directory traversal vulnerability. This vulnerability allows an attacker to access files outside of the intended directory by exploiting the lack of path sanitization in the fs.readFile function in index.js.
Vulnerability Detail
The directory traversal vulnerability in fast-http can have serious ramifications. An attacker can exploit this vulnerability to read sensitive files on the server, such as configuration files or user data. This can lead to unauthorized access, data leakage, or even remote code execution. The vulnerability is rated as HIGH severity with a CVSS score of 7.5. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-22.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating to a patched version of fast-http is not immediately possible, a temporary workaround is to implement path sanitization manually before passing the path to the fs.readFile function. Here is an example of how to sanitize the path using the path module in Node.js:
const path = require('path');
const filePath = path.resolve(__dirname, 'path/to/file');
By resolving the file path with the path.resolve function, the path will be normalized and any directory traversal attempts will be prevented.
Conclusion
The directory traversal vulnerability in fast-http can have serious consequences, including unauthorized access and data leakage. It is crucial to update to a patched version of fast-http or implement path sanitization to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fast-http →
FAQ
fast-http is an npm package that provides functionality for handling HTTP requests and responses in a fast and efficient manner. It is widely used in web applications to improve performance.
Directory traversal is a vulnerability that allows an attacker to access files outside of the intended directory. By manipulating file paths, an attacker can navigate to sensitive files on the server.
The directory traversal vulnerability in fast-http can lead to unauthorized access, data leakage, and even remote code execution. An attacker could read sensitive files containing configuration data or user information.
To fix the vulnerability, update to a version of fast-http that includes a patch for the directory traversal issue. Alternatively, implement path sanitization manually before passing the path to the fs.readFile function.
Yes, a temporary workaround is to implement path sanitization manually using the path module in Node.js. By resolving the file path with the path.resolve function, the path will be normalized and any directory traversal attempts will be prevented.
