Sonya Moisset
Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks
#1about 3 minutes
Defining path traversal and its severe impact
Path traversal is a vulnerability where attackers exploit insufficient validation of user-supplied file names to access restricted files, leading to information exposure and vulnerability chaining.
#2about 3 minutes
Examining high-impact path traversal exploits in the wild
Major software like Zimbra and Apache HTTP Server have suffered from critical, unauthenticated path traversal vulnerabilities leading to widespread system compromise.
#3about 7 minutes
How URL encoding bypassed security in the `st` package
Attackers bypassed path normalization in the popular `st` NPM package using URL-encoded characters, a vulnerability fixed by first decoding the URI component and then normalizing the path.
#4about 5 minutes
Exfiltrating local files via a VS Code extension
The "Open in Default Browser" VS Code extension contained a path traversal flaw that allowed attackers to trick users into exfiltrating local files like SSH keys.
#5about 4 minutes
A critical path traversal flaw in the Node.js runtime
A specific version of the Node.js runtime had an improper path sanitization issue that made applications vulnerable to directory traversal by default.
#6about 3 minutes
Key takeaways and tools for preventing path traversal
Path traversal is an omnipresent risk that can be mitigated by understanding API function order and using automated security scanning tools directly in your IDE.
Related jobs
Jobs that call for the skills explored in this talk.
Matching moments
08:22 MIN
How attackers exploit developers and packages
Vue3 practical development
08:16 MIN
Common attacks targeting software developers
Vulnerable VS Code extensions are now at your front door
00:03 MIN
Why developers are a prime target for attackers
You click, you lose: a practical look at VSCode's security
27:19 MIN
Key takeaways on IDE and developer tool security
You click, you lose: a practical look at VSCode's security
20:46 MIN
Exploiting path traversal in the Instant Markdown extension
Vue3 practical development
15:35 MIN
Modern cybersecurity challenges for developers
Cyber Security: Small, and Large!
05:28 MIN
A historical parallel with the event-stream NPM hack
Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor
10:37 MIN
Demonstrating a supply chain attack using NPM hooks
Hacking Kubernetes: Live Demo Marathon
Featured Partners
Related Videos
29:47You click, you lose: a practical look at VSCode's security
Thomas Chauchefoin & Paul Gerste
30:54Cross Site Scripting is yesterday's news, isn't it?
Martina Kraus
44:11Vulnerable VS Code extensions are now at your front door
Raul Onitza-Klugman & Kirill Efimov
28:41101 Typical Security Pitfalls
Alexander Pirker
26:59Security in modern Web Applications - OWASP to the rescue!
Jakub Andrzejewski
27:41Friend or Foe? TypeScript Security Fallacies
Liran Tal
37:36Walking into the era of Supply Chain Risks
Vandana Verma
1:58:59Stranger Danger: Your Java Attack Surface Just Got Bigger
Vandana Verma Sehgal
From learning to earning
Jobs that call for the skills explored in this talk.
IT-Security Engineer Awarness Training and Security Roadmap
Paris Lodron-Universität Salzburg
Powershell
Windows Server
Microsoft Office
Scripting (Bash/Python/Go/Ruby)