Executive Summary

This vulnerability exists in @fastify/static versions 8.0.0 through 9.1.0 when directory listing is enabled via the list option.

The issue arises because the dirList.path() function uses path.join() to resolve directories without checking if the resolved path stays within the configured static root.

As a result, a remote unauthenticated attacker can perform a path traversal attack to obtain directory listings for arbitrary directories accessible to the Node.js process.

While the attacker can see directory and file names, the contents of the files are not disclosed.

The vulnerability can be fixed by upgrading to @fastify/static version 9.1.1 or by disabling directory listing by removing the list option from the plugin configuration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote unauthenticated attacker to obtain directory listings of arbitrary directories accessible to the Node.js process.

The attacker can discover directory and file names outside the intended static root, which may reveal sensitive information about the file structure.

However, the contents of the files are not disclosed, limiting the impact to information disclosure of file and directory names only.

This information disclosure could aid attackers in further attacks or reconnaissance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade @fastify/static to version 9.1.1 or later.

As a workaround, disable directory listing by removing the list option from the plugin configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a remote unauthenticated attacker to obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. Although file contents are not disclosed, the exposure of directory and file names could potentially lead to information disclosure risks.

Such information disclosure may impact compliance with standards and regulations like GDPR or HIPAA, which require protection of sensitive information and proper access controls. However, the CVE description does not explicitly state the impact on compliance with these regulations.

Useful 0 Not Useful 0