CVE-2016-10528 Directory Traversal in restafary
Attackers can bypass root path restrictions to read or modify files outside the intended directory in the restafary Node.js module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10528?
CVE-2016-10528 is a medium-severity path traversal vulnerability in HackerOne restafary node module, published on 31 May 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.
Weakness: CWE-22
Which versions are affected by CVE-2016-10528?
2 open source packages ship an affected version, including restafary. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
restafary npm | All versions | 1.6.1 |
restafary npm | All versions | 1.6.1 |
Products include Restafary Project Restafary.
How do I fix CVE-2016-10528?
Upgrade restafary to 1.6.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2016-10528 being exploited?
There is no known exploitation of CVE-2016-10528 in the wild and no public exploit code.
Sources
Also known as GHSA-xg5r-8j97-2wrj.