Path Traversal Vulnerability in Mockoon Prior to 9.7.0

Compliance Impact

The vulnerability allows unauthenticated attackers to read files outside the intended served directory, potentially exposing sensitive or confidential data.

Such unauthorized data access can lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Because the vulnerability impacts confidentiality by enabling access to files that should be restricted, it poses a risk to compliance with these regulations.

The fix in version 9.7.0 mitigates this risk by properly restricting file path access within the allowed base directory.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Mockoon to version 9.7.0 or later, where the vulnerability is fixed by replacing the insecure path validation with a robust containment check.

If upgrading immediately is not possible, restrict access to the Mockoon service to trusted users or networks to reduce the risk of exploitation.

Review and sanitize any user input used in file path templates to prevent injection of path traversal sequences.

Consider implementing additional file system access controls or sandboxing to limit the impact of potential traversal attempts.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a path traversal issue in Mockoon versions prior to 9.7.0. It occurs because the application uses a flawed method to validate file paths when serving FILE responses that embed request data. Specifically, it checks if the resolved file path starts with the base directory path using a simple string prefix check, which does not consider path-separator boundaries. This allows an attacker to craft paths with '../' sequences that escape the intended directory and access files in sibling directories outside the served directory.

The vulnerability allows unauthenticated clients to read arbitrary files outside the allowed directory via HTTP sendFile, WebSocket, or callbacks. The issue was fixed in version 9.7.0 by replacing the prefix check with a more robust path containment validation that properly restricts file access within the base directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive files located outside the intended served directory. An attacker can exploit it to read configuration files, environment variables, or other sensitive data stored in sibling directories, potentially exposing secrets or private information.

Since the vulnerability allows unauthenticated access, it increases the risk of data leakage without requiring any credentials. The CVSS v3.1 score of 6.5 reflects a medium severity with high confidentiality impact but no impact on integrity or availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves path traversal through crafted file paths in Mockoon versions prior to 9.7.0. Detection can focus on monitoring HTTP requests that attempt to access files outside the intended served directory by using path traversal patterns such as '../'.

You can detect potential exploitation attempts by inspecting web server logs or network traffic for requests containing suspicious file path parameters embedding '../' sequences or other traversal patterns.

• Use tools like grep or similar to search logs for traversal patterns, for example: grep -r "\.\./" /path/to/mockoon/logs
• Monitor HTTP requests with curl or tcpdump to capture suspicious requests, e.g., tcpdump -A -s 0 'tcp port 3000' | grep '../'
• If you have access to the Mockoon server, review configuration or code for usage of templated file paths that embed request data, which may be vulnerable.

Useful 0 Not Useful 0