Sonya Moisset

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Are you decoding URLs before or after normalizing paths? The wrong order can expose every file on your Node.js server.

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks
#1about 3 minutes

Defining path traversal and its severe impact

Path traversal is a vulnerability where attackers exploit insufficient validation of user-supplied file names to access restricted files, leading to information exposure and vulnerability chaining.

#2about 3 minutes

Examining high-impact path traversal exploits in the wild

Major software like Zimbra and Apache HTTP Server have suffered from critical, unauthenticated path traversal vulnerabilities leading to widespread system compromise.

#3about 7 minutes

How URL encoding bypassed security in the `st` package

Attackers bypassed path normalization in the popular `st` NPM package using URL-encoded characters, a vulnerability fixed by first decoding the URI component and then normalizing the path.

#4about 5 minutes

Exfiltrating local files via a VS Code extension

The "Open in Default Browser" VS Code extension contained a path traversal flaw that allowed attackers to trick users into exfiltrating local files like SSH keys.

#5about 4 minutes

A critical path traversal flaw in the Node.js runtime

A specific version of the Node.js runtime had an improper path sanitization issue that made applications vulnerable to directory traversal by default.

#6about 3 minutes

Key takeaways and tools for preventing path traversal

Path traversal is an omnipresent risk that can be mitigated by understanding API function order and using automated security scanning tools directly in your IDE.

Related jobs
Jobs that call for the skills explored in this talk.

Featured Partners

Related Videos

See all videos
You click, you lose: a practical look at VSCode's security29:47

You click, you lose: a practical look at VSCode's security

Thomas Chauchefoin & Paul Gerste

Cross Site Scripting is yesterday's news, isn't it?30:54

Cross Site Scripting is yesterday's news, isn't it?

Martina Kraus

Vulnerable VS Code extensions are now at your front door44:11

Vulnerable VS Code extensions are now at your front door

Raul Onitza-Klugman & Kirill Efimov

101 Typical Security Pitfalls28:41

101 Typical Security Pitfalls

Alexander Pirker

Security in modern Web Applications - OWASP to the rescue!26:59

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

Friend or Foe? TypeScript Security Fallacies27:41

Friend or Foe? TypeScript Security Fallacies

Liran Tal

Walking into the era of Supply Chain Risks37:36

Walking into the era of Supply Chain Risks

Vandana Verma

Stranger Danger: Your Java Attack Surface Just Got Bigger1:58:59

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

From learning to earning

Jobs that call for the skills explored in this talk.