[FIX] Path traversal disabling symlink

[Mik317]

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-npm-httpster

⚙️ Description *

The httpster file server was vulnerable against a path traversal issue which existed because symlinks were fetched and their content served without any warn/error.

💻 Technical Description *

I inserted a new router inside the express server which was created by httpster and used fs.lstat to check if the requested file is or not a symlink.
In case it is and the --symlink flag isn't specified by the server (default false like in other servers like Nginx), an error is thrown.

🐛 Proof of Concept (PoC) *

1. Download httpster
2. ln -s /etc/passwd test
3. httpster
4. Go on http://localhost:3333/test and the content of the /etc/passwd file is shown

🔥 Proof of Fix (PoF) *

1. Same steps above, but an error is given instead of the content of the /etc/passwd file

1. Same steps but start the server with httpster --symlink and the /etc/passwd file is shown (option)

👍 User Acceptance Testing (UAT)

All ok 😄

[bbeale]

[huntr-helper]

Congratulations Mik317 - your fix has been selected! 🎉

Thanks for being part of the community & helping secure the world's open source code.
If you have any questions, please respond in the comments section. Your bounty is on its way - keep hunting!