1

I am working on a project which requires the name of the page as a query parameter 'path'. The app stores path variable as res.query.path. My manager asked me to pay attention to LFI, so I'm concerned about it. The app is using Express.JS, and no PHP.

My question is if the input is not handled carefully, is it still vulnerable to PHP wrappers?

5
  • 1
    Does this answer your question? How to prevent directory traversal when joining paths in node.js? Jun 24 '20 at 4:15
  • If you're not using PHP, then why are you worried about PHP? Jun 24 '20 at 4:15
  • @multithr3at3d I just asked if I should be worried about wrappers, I read about them in several articles and hence I'm not very sure about their implementation Jun 24 '20 at 4:19
  • @multithr3at3d I want to know how my current code is vulnerable Jun 24 '20 at 4:21
  • It's pretty poor form to try and upload a CTF challenge directly in the hopes that someone will solve it for you. Try Harder.
    – thel3l
    Jun 25 '20 at 13:42
0

The app is using JS(express) and no PHP, so my first question is if the input is not handled carefully is it still vulnerable to PHP wrappers?

PHP wrappers concerns php based application and has nothing to do with ways express js handles data.

I've written a small function to sanitize user input. Please tell me if it vulnerable in an environment where the path parameter is being prepended using the below function prepare for getting an absolute path that is then used as input to res.sendFile().

The code will not prevent you from getting hacked if the logic behind it is incorrect. The LFI not only means inclusion of local system files but also file uploaded by attacker to spawn shell as an attempt for escalation of privileges. In such case ../ shall not be the only thing to look for.

In the app's request flow's last step, consider this as suggested addition:

res.sendFile((if possible)check if the intended page will be prepared and it is surely not from system files or the page to be prepared belongs from specific directory of the server & then prepare(page))

0

Not the answer you're looking for? Browse other questions tagged or ask your own question.