CVE-2014-125068: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in saxman maps-js-icoads and classified as critical. This issue affects some unknown processing of the file http-server.js. The manipulation leads to path traversal. The patch is named 34b8b0cce2807b119f4cffda2ac48fc8f427d69a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217643.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2023-01-08T11:15Z
Repository: https://github.com/saxman/maps-js-icoads
Language: JavaScript
Files changed: http-server.js
Commit date: 2014-09-02 13:07:09 -0700
Commit message: Return index.html for directory req's and prevent directory traversal req's

Diff: diff --git a/http-server.js b/http-server.js
index 55dd99e..e8572e9 100644
--- a/http-server.js
+++ b/http-server.js
@@ -1,7 +1,8 @@
 var http = require('http');
 var fs = require('fs');
+var path = require('path');
 
 fs.exists = fs.exists || require('path').exists;
 
 var SERVER_PORT = 8080;
 
@@ -15,32 +16,48 @@ var FILE_EXT_JS = '.js';
 var MIME_TYPE_GZIP = 'text/plain';
 var MIME_TYPE_JS = 'text/javascript';
 var MIME_TYPE_CSS = 'text/css';
 
 function log(code, string) {
-  //console.log('[' + code + '] ' + string);
+//  console.log('[' + code + '] ' + string);
 }
 
 var server = http.createServer(function(request, response) {
   var filePath = request.url;
 
   // Remove query strings from uri
   if (filePath.indexOf('?') > -1) {
     filePath = filePath.substr(0, filePath.indexOf('?'));
   }
 
-  filePath = '.' + filePath;
+  // Get the absolute path for the request
+  filePath = path.resolve('.' + filePath);
+
+  // Rejesct queries ouside of the server root
+  var serverPath = path.resolve('.');
+  if (filePath.indexOf(serverPath) != 0 ) {
+    log(403, filePath);
+    response.writeHeader(403);
+    response.end();
+
+    return;
+  }
 
   fs.exists(filePath, function(exists) {
     if (!exists) {
-      log(404, filePath)
+      log(404, filePath);
       response.writeHead(404);
       response.end();
 
       return;
     }
 
+    // Return index.html if directroy requested.
+    if (fs.statSync(filePath).isDirectory()) {
+      filePath += '/index.html';
+    }
+
     var mimeType = '';
     var fileType = -1;
 
     if (filePath.substring(filePath.length - FILE_EXT_GZIP.length) == FILE_EXT_GZIP) {
       fileType = FILE_TYPE_GZIP;

Vulnerable code:   //console.log('[' + code + '] ' + string);
  filePath = '.' + filePath;
      log(404, filePath)
Fixed code: var path = require('path');
//  console.log('[' + code + '] ' + string);
  // Get the absolute path for the request
  filePath = path.resolve('.' + filePath);

  // Rejesct queries ouside of the server root
  var serverPath = path.resolve('.');
  if (filePath.indexOf(serverPath) != 0 ) {
    log(403, filePath);
    response.writeHeader(403);
    response.end();

    return;
  }
      log(404, filePath);
    // Return index.html if directroy requested.
    if (fs.statSync(filePath).isDirectory()) {
      filePath += '/index.html';
    }