CVE-2020-15779
📋 TL;DR
This path traversal vulnerability in socket.io-file allows attackers to write files outside the intended upload directory by using directory traversal sequences (../) in file names. It affects Node.js applications using socket.io-file version 2.0.31 and earlier. Attackers can potentially overwrite critical system files or deploy malicious code.
💻 Affected Systems
- socket.io-file
📦 What is this software?
Socket.io File by Socket.io File Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to remote code execution, data destruction, or privilege escalation.
Likely Case
Unauthorized file writes to sensitive directories, potentially leading to data manipulation, denial of service, or lateral movement.
If Mitigated
Limited to file writes within controlled directories with proper input validation and file system permissions.
🎯 Exploit Status
Exploitation requires only the ability to upload files via socket.io-file interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.32
Vendor Advisory: https://github.com/advisories/GHSA-9h4g-27m8-qjrg
Restart Required: Yes
Instructions:
1. Update socket.io-file to version 2.0.32 or later using npm update socket.io-file. 2. Restart your Node.js application. 3. Verify the update with npm list socket.io-file.
🔧 Temporary Workarounds
Input validation filter
allImplement server-side validation to reject file names containing path traversal sequences.
// Example Node.js middleware to filter ../ sequences
app.use((req, res, next) => {
if (req.body.filename && req.body.filename.includes('..')) {
return res.status(400).send('Invalid filename');
}
next();
});
🧯 If You Can't Patch
- Implement strict file system permissions limiting write access to specific directories only.
- Deploy web application firewall (WAF) rules to block requests containing path traversal patterns.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list socket.io-file to see if version <= 2.0.31 is installed.Check Version:
npm list socket.io-fileVerify Fix Applied:
Confirm socket.io-file version is 2.0.32 or higher using npm list socket.io-file.📡 Detection & Monitoring
Log Indicators:
- File upload attempts with filenames containing ../ sequences
- Unexpected file writes outside designated upload directories
Network Indicators:
- HTTP POST requests to upload endpoints with suspicious filename parameters
- Socket.io messages with createFile containing path traversal patterns
SIEM Query:
source="application.log" AND ("../" OR "..\" OR "%2e%2e%2f") AND ("upload" OR "createFile")🔗 References
- https://github.com/advisories/GHSA-9h4g-27m8-qjrg
- https://github.com/rico345100/socket.io-file
- https://www.npmjs.com/advisories/1519
- https://www.npmjs.com/package/socket.io-file
- https://github.com/advisories/GHSA-9h4g-27m8-qjrg
- https://github.com/rico345100/socket.io-file
- https://www.npmjs.com/advisories/1519
- https://www.npmjs.com/package/socket.io-file
