T09 · Insecure Skill Coding Practices
Error
- Location
scripts/push_images.js:40- Finding
Public HTTP Server Permits Path Traversal and Arbitrary File Disclosure
- Content
View full analysis
{ const filePath = path.join(dir, req.url.replace(/^\//, '')); if (fs.existsSync(filePath)) { res.writeHead(200, { 'Content-Type': 'image/jpeg' }); fs.createReadStream(filePath).pipe(res); } else { res.writeHead(404); res.end(); } }); server.listen(port, '0.0.0.0'); return server; } ``` ### Technical Analysis The HTTP request path is passed directly to `path.join()` without canonicalizing the final path and verifying that it remains inside the intended image directory. Traversal components such as `../` can therefore cause `filePath` to resolve outside `dir`. The implementation also: - Binds the server to `0.0.0.0`, exposing it on every available network interface. - Does not require authentication or an unguessable access token. - Does not restrict responses to generated `*_fixed.jpg` files. - Uses `fs.existsSync()` without confirming that the target is a permitted regular file. - Assigns an image MIME type to every returned file, but this does not prevent the underlying contents from being disclosed. The server remains available for 15 minutes after listing updates are submitted, creating a meaningful exploitation window on any host whose configured port is publicly reachable. ### Attack Path 1. An operator starts `push_images.js` on a host with the selected port exposed. 2. The server listens publicly on `0.0.0.0`, normally using port 8899. 3. A remote attacker discovers or already knows the host and port. 4. The attacker sends a request containing traversal components, such as a path targeting `../amazon-sp-api.json`. The attacker can use a client that preserves traversal components if an inte ...[truncated 1049 chars]- Remediation
View remediation