Description
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-send | 0.9.4-1 | — |
| Debian 13 | node-send | 0.9.4-1 | — |
| Debian 12 | node-send | 0.9.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-send | 0.9.4-1 | — |
| Ubuntu 16.04 LTS | node-send | 0.9.4-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | send | < 0.8.4 | 0.8.4 | GHSA-xwg4-93c6-3h42 |
References
- 62170 third-party-advisory
- [oss-security] 20140924 Re: CVE request: various NodeJS module vulnerabilities mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1146063
- https://nodesecurity.io/advisories/send-directory-traversal
- https://github.com/visionmedia/send/pull/59
- https://support.apple.com/HT205217
- https://github.com/visionmedia/send/commit/9c6ca9b2c0b880afd3ff91ce0d211213c5fa5f9a
- APPLE-SA-2015-09-16-2 vendor-advisory
- FEDORA-2014-11495 vendor-advisory
- FEDORA-2014-11421 vendor-advisory
- 70100 vdb-entry
- nodejs-cve20146394-dir-traversal(96727) vdb-entry
- http://www-01.ibm.com/support/docview.wss?uid=swg21687263
- FEDORA-2014-11289 vendor-advisory
- [oss-security] 20140924 CVE request: various NodeJS module vulnerabilities mailing-list