Security Fix for Directory Traversal - huntr.dev

[huntr-helper]

https://huntr.dev/users/alromh87 has fixed the Directory Traversal vulnerability 🔨. alromh87 has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/quickserver/1/README.md

User Comments:

📊 Metadata *

quickserver is Quickly start a Node.js instance serving static files,
this package is vulnerable to Directory Traversal, which may allow access to sensitive files and data on the server.

Bounty URL: https://www.huntr.dev/bounties/1-npm-quickserver

⚙️ Description *

There is no path sanitization in the path provided making quickserver vulnerable against path traversal through the ../ technique, leading to information exposure and file content disclosure.

💻 Technical Description *

Fixed by sanitizing any occurrence of ../, using regexp.

🐛 Proof of Concept (PoC) *

1. Start the server
   ./bin/quickserver
2. Request private file from server
   curl -v --path-as-is http://127.0.0.1:8080/../../../../../../../../../../../etc/passwd
3. /etc/passwd will be displayed.
   

🔥 Proof of Fix (PoF) *

After fix Response code 400 Bad request is returned to user instead of restricted file content

👍 User Acceptance Testing (UAT)

After fix functionality is unafected