Path Traversal in cube-root/directory-serve

Executive Summary

This is a path traversal vulnerability in the cube-root/directory-serve tool through version 1.3.7. When the application is run with the --delete option, an unauthenticated remote attacker can delete arbitrary files outside the intended directory. The vulnerability occurs because the file-remove.js middleware does not properly sanitize the req.query.file parameter before using it to construct file system paths, allowing directory traversal via sequences like ../.

Useful 0 Not Useful 0

Detection Guidance

Check if directory-serve is running with the --delete option by inspecting process commands. Look for unusual file deletions in logs or unexpected file system changes. Test by attempting to access ../ paths in file removal requests.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete critical system files, application data, or sensitive user files outside the intended directory. This could lead to denial of service, data loss, or system compromise depending on which files are targeted. The high CVSS score indicates the potential for significant impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially violating data integrity requirements in GDPR and HIPAA. If sensitive personal or health data is deleted, it may constitute a data breach requiring notification under these regulations. The lack of proper access controls also undermines security requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Stop using directory-serve with the --delete option immediately. Update to the latest patched version if available. Implement network-level restrictions to block unauthorized file deletion requests.

Useful 0 Not Useful 0