CVE-2014-125069: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in saxman maps-js-icoads. It has been classified as problematic. Affected is an unknown function. The manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely. The name of the patch is 34b8b0cce2807b119f4cffda2ac48fc8f427d69a. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217644.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2023-01-08T11:15Z
Repository: https://github.com/saxman/maps-js-icoads
Language: JavaScript
Files changed: http-server.js
Commit date: 2014-09-02 13:07:09 -0700
Commit message: Return index.html for directory req's and prevent directory traversal req's

Diff: diff --git a/http-server.js b/http-server.js
index 55dd99e..e8572e9 100644
--- a/http-server.js
+++ b/http-server.js
@@ -1,7 +1,8 @@
 var http = require('http');
 var fs = require('fs');
+var path = require('path');
 
 fs.exists = fs.exists || require('path').exists;
 
 var SERVER_PORT = 8080;
 
@@ -15,32 +16,48 @@ var FILE_EXT_JS = '.js';
 var MIME_TYPE_GZIP = 'text/plain';
 var MIME_TYPE_JS = 'text/javascript';
 var MIME_TYPE_CSS = 'text/css';
 
 function log(code, string) {
-  //console.log('[' + code + '] ' + string);
+//  console.log('[' + code + '] ' + string);
 }
 
 var server = http.createServer(function(request, response) {
   var filePath = request.url;
 
   // Remove query strings from uri
   if (filePath.indexOf('?') > -1) {
     filePath = filePath.substr(0, filePath.indexOf('?'));
   }
 
-  filePath = '.' + filePath;
+  // Get the absolute path for the request
+  filePath = path.resolve('.' + filePath);
+
+  // Rejesct queries ouside of the server root
+  var serverPath = path.resolve('.');
+  if (filePath.indexOf(serverPath) != 0 ) {
+    log(403, filePath);
+    response.writeHeader(403);
+    response.end();
+
+    return;
+  }
 
   fs.exists(filePath, function(exists) {
     if (!exists) {
-      log(404, filePath)
+      log(404, filePath);
       response.writeHead(404);
       response.end();
 
       return;
     }
 
+    // Return index.html if directroy requested.
+    if (fs.statSync(filePath).isDirectory()) {
+      filePath += '/index.html';
+    }
+
     var mimeType = '';
     var fileType = -1;
 
     if (filePath.substring(filePath.length - FILE_EXT_GZIP.length) == FILE_EXT_GZIP) {
       fileType = FILE_TYPE_GZIP;

Vulnerable code:   //console.log('[' + code + '] ' + string);
  filePath = '.' + filePath;
      log(404, filePath)
Fixed code: var path = require('path');
//  console.log('[' + code + '] ' + string);
  // Get the absolute path for the request
  filePath = path.resolve('.' + filePath);

  // Rejesct queries ouside of the server root
  var serverPath = path.resolve('.');
  if (filePath.indexOf(serverPath) != 0 ) {
    log(403, filePath);
    response.writeHeader(403);
    response.end();

    return;
  }
      log(404, filePath);
    // Return index.html if directroy requested.
    if (fs.statSync(filePath).isDirectory()) {
      filePath += '/index.html';
    }