T09 · Insecure Skill Coding Practices
Error
- Location
scripts/push_images.js:42- Finding
Public Path Traversal Allows Arbitrary Local File Disclosure
- Content
View full analysis
{ const filePath = path.join(dir, req.url.replace(/^\//, '')); if (fs.existsSync(filePath)) { res.writeHead(200, { 'Content-Type': 'image/jpeg' }); fs.createReadStream(filePath).pipe(res); } else { res.writeHead(404); res.end(); } }); server.listen(port, '0.0.0.0'); return server; } ``` ### Technical Analysis The HTTP request path is joined directly to the configured image directory without decoding and validating the path, checking its canonical location, restricting file extensions, or authenticating the requester. Traversal components such as `../` can therefore cause the resolved path to escape the intended image directory. The server binds to `0.0.0.0`, making it accessible through every available network interface. The documented workflow expects this port to be publicly reachable so Amazon can retrieve images. Consequently, the vulnerable handler can be exposed to arbitrary Internet clients during the 15-minute serving period. `fs.existsSync()` only verifies that the resulting path exists; it does not establish that the path is inside the authorized directory or that it is an approved image. Setting `Content-Type` to `image/jpeg` does not protect the underlying contents from disclosure. ### Attack Path 1. An operator starts `push_images.js` on a publicly reachable system. 2. The script binds its HTTP server to all interfaces on port 8899 or a user-selected port. 3. An attacker identifies the exposed service during its serving window. 4. The attacker sends a request containing traversal components, such as `/../../amazon-sp-api.json`, adjusted for the configured image-directory depth. 5. `pat ...[truncated 943 chars]- Remediation
View remediation