Directory Traversal in send
Published 24 Oct 2017 · Updated 8 Nov 2023
Affected package
- Affected
- <0.8.4
- Fixed in
- 0.8.4
npm install send@0.8.4Details
Versions 0.8.3 and earlier of send are affected by a directory traversal vulnerability. When relying on the root option to restrict file access it may be possible for an application consumer to escape out of the restricted directory and access files in a similarly named directory.
For example, static(_dirname + '/public') would allow access to _dirname + '/public-restricted'.
Recommendation
Update to version 0.8.4 or later.
Is GHSA-xwg4-93c6-3h42 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected send, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2014-6394
- Linkgithub.com/visionmedia/send/pull/59
- Linkgithub.com/visionmedia/send/commit/9c6ca9b2c0b880afd3ff91ce0d211213c5fa5f9a
- Linkbugzilla.redhat.com/show_bug.cgi?id=1146063
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/96727
- Advisorygithub.com/advisories/GHSA-xwg4-93c6-3h42
- Packagegithub.com/visionmedia/send
- Linksupport.apple.com/HT205217
- Linkwww.npmjs.com/advisories/32
- Linklists.apple.com/archives/security-announce/2015/Sep/msg00002.html
- Linklists.fedoraproject.org/pipermail/package-announce/2014-October/139938.html
- Linklists.fedoraproject.org/pipermail/package-announce/2014-October/140020.html
- Linklists.fedoraproject.org/pipermail/package-announce/2014-September/139415.html
- Linksecunia.com/advisories/62170
- Linkwww-01.ibm.com/support/docview.wss?uid=swg21687263
- Linkwww.openwall.com/lists/oss-security/2014/09/24/1
- Linkwww.openwall.com/lists/oss-security/2014/09/30/10
- Linkwww.securityfocus.com/bid/70100
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.