CVE-2014-6394: Path Traversal
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Other sources
When relying on the root option to restrict file access it may be possible for an application consumer to escape out of the restricted directory and access files in a similarly named directory. For example, static(dirname + '/public') would allow access to dirname + '/public-restricted'.
Upstream commit: https://github.com/visionmedia/send/commit/9c6ca9b2c0b880afd3ff91ce0d211213c5fa5f9a Corresponding pull request: https://github.com/visionmedia/send/pull/59 CVE request: http://seclists.org/oss-sec/2014/q3/640
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6394?
CVE-2014-6394 is classified as a moderate severity vulnerability due to its potential to allow unauthorized access to restricted directories.
How do I fix CVE-2014-6394?
To fix CVE-2014-6394, upgrade to version 0.8.4 or newer of the affected software, specifically nodejs-send.
What software is affected by CVE-2014-6394?
CVE-2014-6394 affects visionmedia send versions prior to 0.8.4 for Node.js.
Can CVE-2014-6394 allow remote access to files?
Yes, CVE-2014-6394 can allow remote attackers to access restricted directories, posing a security risk.
What types of systems are impacted by CVE-2014-6394?
CVE-2014-6394 impacts several systems including Fedora versions 19 to 21 and older versions of Node.js.