CVE-2014-6394 Directory Traversal in send
Remote attackers can access restricted directories outside the document root due to flawed path verification in the Node.js send library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-6394?
CVE-2014-6394 is a high-severity path traversal vulnerability in Apple Xcode, published on 8 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Weakness: CWE-22
Which versions are affected by CVE-2014-6394?
2 open source packages ship an affected version, including send. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
send npm | All versions | 0.8.4 |
send npm | All versions | 0.8.4 |
Products include Apple Xcode, Fedoraproject Fedora, Joyent Node.js.
How do I fix CVE-2014-6394?
Upgrade send to 0.8.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2014-6394 being exploited?
There is no known exploitation of CVE-2014-6394 in the wild and no public exploit code.
Other vulnerabilities in Apple Xcode
Sources
Also known as CLSA-2026-1793287341, DEBIAN-CVE-2014-6394, GHSA-xwg4-93c6-3h42, UBUNTU-CVE-2014-6394.