T09 · Insecure Skill Coding Practices
Error
- Location
scripts/push_images.js:44- Finding
Unauthenticated Public File Server Allows Directory Traversal and Arbitrary File Disclosure
- Content
View full analysis
{ const filePath = path.join(dir, req.url.replace(/^\//, '')); if (fs.existsSync(filePath)) { res.writeHead(200, { 'Content-Type': 'image/jpeg' }); fs.createReadStream(filePath).pipe(res); } else { res.writeHead(404); res.end(); } }); server.listen(port, '0.0.0.0'); return server; } ``` ### Technical Analysis The temporary image server binds to `0.0.0.0`, making it accessible through every network interface. It does not authenticate requests or restrict access to expected image filenames. The request URL is joined directly to the configured image directory: ```js path.join(dir, req.url.replace(/^\//, '')) ``` No canonicalization or containment check ensures that the resulting path remains inside `dir`. A raw request path containing parent-directory components can therefore resolve outside the intended image directory. The code also follows ordinary filesystem resolution behavior and does not reject symbolic links, directories, or non-image files. The forced `Content-Type` header does not prevent disclosure because the underlying bytes of any readable file are still returned. ### Attack Path 1. The operator runs the documented image upload workflow. 2. The server starts on a publicly reachable interface and normally remains active for 15 minutes. 3. An attacker discovers or already knows the server's public IP and port. 4. The attacker submits an HTTP request containing path traversal components, such as a raw request for `/../amazon-sp-api.json`, adjusted for the image directory's location. 5. `path.join()` resolves the path outside the image directory. 6. If the target exists and is readable by the process, `createR ...[truncated 782 chars]- Remediation
View remediation