Directory Traversal Vulnerability in node-send Package
Summary
DEBIAN-CVE-2014-6394: visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "pu... Affects node-send versions < 0.9.4-1. Fixed in 0.9.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-send package is a middleware for Node.js that facilitates sending files and directories over HTTP. It is widely used in web applications to manage file transfers efficiently. However, certain versions of node-send are vulnerable to a directory traversal attack, which can allow unauthorized access to restricted directories within the application.
Vulnerability Detail
The vulnerability arises from a partial comparison method used by visionmedia send before version 0.8.4 for Node.js. This method fails to adequately verify whether a requested directory is within the document root, allowing remote attackers to exploit this weakness. As a result, they can access sensitive files and directories that should be restricted, potentially leading to data exposure or unauthorized access to the system.
How To Fix
Minimum fixed version
0.9.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-sendTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate the requested paths and ensure they do not traverse outside the intended document root. This can be done by sanitizing input paths and using libraries that provide secure path handling.
Conclusion
The directory traversal vulnerability in the node-send package poses significant risks to applications using affected versions. It is crucial to update to the patched version 0.9.4-1 or later to mitigate these risks. Additionally, implementing workarounds and monitoring tools like Vulert can enhance your application's security posture.
See every vulnerability recorded for node-send →
FAQ
The vulnerability is a directory traversal issue that allows unauthorized access to restricted directories.
Versions of node-send prior to 0.9.4-1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to sensitive files and directories, which can lead to data breaches and security incidents.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-send.
