Directory Traversal in restafary

MOYENNE 4.9CVE-2016-10528 · GHSA-xg5r-8j97-2wrj · Published 31/05/2018 · updated 17/06/2026

En bref

CVE-2016-10528 est une vulnérabilité MOYENNE (CVSS 4.9) touchant restafary (restafary project), restafary.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 67.9% des vulnérabilités.
Correctif : mettre à jour vers 1.6.1 ou plus récent.

Package	Affected versions	Patched versions
restafary restafary_project	`< 1.6.1`	`1.6.1`
restafary npm	`< 1.6.1`	`1.6.1`

Description

Affected versions of restafary are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.

Proof of Concept

curl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'

Recommendation

Update to version 1.6.1 or later.

NVD description

restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.

References

nvd.nist.gov/vuln/detail/CVE-2016-10528 · ADVISORY
GitHub Advisory GHSA-xg5r-8j97-2wrj · ADVISORY
npmjs.com/advisories/89 · WEB
nodesecurity.io/advisories/89 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free