Skip to content
This repository has been archived by the owner on Dec 19, 2023. It is now read-only.

[FIX] Path traversal through Symlink files #2

Merged
merged 10 commits into from
Aug 26, 2020
Merged

Conversation

Mik317
Copy link

@Mik317 Mik317 commented Aug 21, 2020

馃搳 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-npm-superstatic

鈿欙笍 Description *

The superstatic server was vulnerable against a path traversal issue which occurred because symlink files where showed, leading to dangerous scenario which could be exploitable.

馃捇 Technical Description *

In order to avoid the issue, I added the possibility to simply check if the symlink option flag has been set when starting the server. If symlink flag is passed when invoking the superstatic command, the symlinks are showed and fetched successfully, whereas when symlink flag is missed, it's showed a 404 error.

The added flag makes possible switching really simply between the 2 options, and I added a bit of doc in the README to be sure people aware of the options it-self and risks.

Finally, the default value of the symlink flag is false (security reason, shares the same concept of other webserver like Nginx) and if devs are using the lib version, it's necessary just switching the default value to true in case they want to serve also symlink files.

馃悰 Proof of Concept (PoC) *

  1. Install
  2. Go on the bin dir
  3. ./server
  4. Create a symlink like ln -s /etc/passwd test
  5. Go on http://localhost:3474/test
  6. Content of /etc/passwd showed

Screenshot from 2020-08-20 15-01-04

馃敟 Proof of Fix (PoF) *

Same steps with fixed version

Using the symlink flag:
Screenshot from 2020-08-22 00-44-07

Without symlink flag:
Screenshot from 2020-08-22 00-44-19

馃憤 User Acceptance Testing (UAT)

Seems all OK 馃憤

Copy link

@mufeedvh mufeedvh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good fix! 馃憦馃帀

LGTM

@JamieSlome JamieSlome removed the request for review from toufik-airane August 26, 2020 09:37
@JamieSlome JamieSlome merged commit cbe8c43 into 418sec:master Aug 26, 2020
@huntr-helper
Copy link
Member

Congratulations Mik317 - your fix has been selected! 馃帀

Thanks for being part of the community & helping secure the world's open source code.
If you have any questions, please respond in the comments section. Your bounty is on its way - keep hunting!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
4 participants