PT-2020-14625 · Node.Js · Socket.Io-File

Published 2020-07-07 · Updated 2020-07-22 · CVE-2020-15779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions socket.io-file versions through 2.0.31

Description A Path Traversal issue was discovered in the socket.io-file package for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path. The package fails to sanitize user input and uses it to generate the file upload paths, allowing files to be uploaded to arbitrary folders on the server by sending relative paths on the name value.

Recommendations For versions through 2.0.31, consider disabling the socket.io-file::createFile message until a patch is available to prevent exploitation of the Path Traversal issue. Restrict access to the uploadDir and rename options to minimize the risk of arbitrary file uploads. Avoid using the name option in the socket.io-file::createFile message with relative paths until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-15779

GHSA-9H4G-27M8-QJRG

Affected Products

Socket.Io-File

References · 8

• 🔥 https://npmjs.com/advisories/1519 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15779 · Security Note
• https://osv.dev/vulnerability/GHSA-9h4g-27m8-qjrg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15779 · Vendor Advisory
• https://github.com/rico345100/socket.io-file · Note
• https://t.me/cvenotify/5084 · Telegram Post
• https://npmjs.com/package/socket.io-file · Note
• https://github.com/advisories/GHSA-9h4g-27m8-qjrg · Note