T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/register.js:37- Finding
Path Traversal in User Profile Lookup
- Content
View full analysis
'); process.exit(1); } const filePath = path.join(USERS_DIR, `${userId}.json`); if (!fs.existsSync(filePath)) { console.error(`User "${userId}" not found.`); process.exit(1); } const u = JSON.parse(fs.readFileSync(filePath, 'utf8')); console.log(JSON.stringify(u, null, 2)); process.exit(0); } ``` ### Technical Analysis The `--show` operation directly incorporates the supplied `userId` into a filesystem path without validating its format or confirming that the resolved path remains beneath `data/users`. Node.js normalizes traversal components such as `../` when `path.join()` constructs the path. Consequently, an attacker can escape the intended user-profile directory and select another file accessible to the Node.js process. For example, because `USERS_DIR` resolves to `/data/users`, the following value resolves to the project metadata file: ```text userId = ../../_meta result = /data/users/../../_meta.json = /_meta.json ``` The forced `.json` extension and `JSON.parse()` restrict exploitation to readable files containing valid JSON. They do not prevent traversal or disclosure. This branch is inconsistent with the registration path, which restricts identifiers to alphanumeric characters, underscores, and hyphens. ### Attack Path 1. The attacker obtains the ability to invoke `register.js`, directly or through an application that exposes its arguments. 2. The attacker supplies a traversal sequence as the value of `--show`, for example: ```bash node scripts/register.js --show ../../_meta ``` 3. `path.jo ...[truncated 1152 chars]- Remediation
View remediation