Path Traversal in h3 Versions Before 1.15.9

Executive Summary

This is a path traversal vulnerability in the h3 library's serveStatic utility before version 1.15.9. It occurs due to a double-decoding flaw where double-encoded dot sequences like %252e%252e are decoded to %2e%2e. This bypasses the resolveDotSegments function, which only checks for literal dot characters. When resolved by URL-based backends like CDN or S3, %2e%2e is interpreted as '..', allowing attackers to read arbitrary files outside the intended directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running h3 versions before 1.15.9. Use commands like 'npm list h3' or 'yarn list h3' to verify the installed version. Inspect network traffic for requests containing double-encoded dot sequences such as %252e%252e or %252e%252e%252f.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive files on the server, including configuration files, source code, or other restricted data. This could lead to information disclosure, unauthorized access to user data, or further attacks if the exposed files contain credentials or API keys. The impact depends on the backend storage system and the permissions of the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and potentially triggering breach notification requirements. For HIPAA, it may result in unauthorized access to protected health information, leading to compliance violations and penalties. Organizations must address this to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update h3 to version 1.15.9 or later. If updating is not possible, disable the serveStatic utility or restrict access to sensitive directories. Monitor for suspicious file access patterns in logs.

Useful 0 Not Useful 0