Vulnerability in send package: Directory Traversal

Background

The send package is a popular npm module used in Node.js applications for serving static files. It provides functionality for efficiently transferring files from the server to the client. However, versions prior to 0.8.4 are vulnerable to a directory traversal attack, which allows remote attackers to access restricted directories. This vulnerability occurs due to a partial comparison used by the package to verify if a directory is within the document root.

Vulnerability Detail

The directory traversal vulnerability in the send package allows attackers to bypass access restrictions and retrieve sensitive files from the server. By exploiting this vulnerability, an attacker can traverse the directory structure and access files outside the intended document root. For example, an attacker could access the 'public-restricted' directory located under the 'public' directory, which should be restricted from public access. This can lead to unauthorized disclosure of sensitive information and potential compromise of the server.

npm install send@1.2.1

npm install send@0.8.4

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually validating the requested file path against the document root. This can be done by checking if the requested file path is within the document root directory and denying access if it is not. Here is an example of how this can be implemented in Node.js:

const path = require('path');
const send = require('send');

function serveFile(req, res) {
  const requestedFile = req.params.file;
  const documentRoot = path.join(__dirname, 'public');

  if (!requestedFile.startsWith(documentRoot)) {
    res.status(403).send('Access denied.');
    return;
  }

  send(req, requestedFile).pipe(res);
}

Conclusion

The directory traversal vulnerability in the send package can have serious security implications for Node.js applications. It is crucial to upgrade to version 0.8.4 or later to mitigate this vulnerability. If immediate upgrade is not possible, implementing the suggested workaround can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for send →

FAQ