Mockoon, Path Traversal & LFI, CVE-2023-XXXX (Critical)

Listen to this Post

🐢▶️ Listen🚀

How the CVE Works:

The vulnerability arises in Mockoon’s static file serving configuration, where the `filePath` variable is generated using a templating feature (TemplateParser) that processes user input without proper sanitization. This allows an attacker to manipulate the path traversal sequences (e.g., ../../../../../etc/passwd) in the request parameters. When the server processes the request, it constructs the final file path using the unsanitized input, leading to Local File Inclusion (LFI) and Path Traversal. This enables unauthorized access to sensitive files on the server filesystem, such as `/etc/passwd` in a Docker container environment. The issue is exacerbated in cloud-hosted instances, where attackers can exploit this to access critical system files.

DailyCVE Form:

Platform: Mockoon
Version: Latest (mockoon-cli)
Vulnerability: Path Traversal & LFI
Severity: Critical
Date: 2023-XX-XX

What Undercode Say:

Exploitation:

1. Payload Construction: Use URL-encoded path traversal sequences like `%2F..%2F..%2Fetc%2Fpasswd` to bypass basic filtering.
2. Request Execution: Send a crafted HTTP request to the vulnerable endpoint, e.g., `http://localhost:3000/static/%2F..%2F..%2Fetc%2Fpasswd`.
3. File Extraction: Retrieve sensitive files from the server filesystem, such as configuration files, environment variables, or system files.

Protection:

1. Input Sanitization: Implement strict validation and sanitization of user input to block path traversal sequences.
2. Path Normalization: Use libraries like `path.normalize()` in Node.js to resolve and sanitize file paths.
3. Access Control: Restrict file access to predefined directories using whitelists.
4. Security Headers: Deploy Content Security Policy (CSP) headers to mitigate exploitation risks.
5. Regular Updates: Ensure the Mockoon CLI and dependencies are updated to the latest secure versions.

Commands:

• Run Mockoon Container Securely:

  docker run -d --mount type=bind,source=./config.json,target=/data,readonly -v ./static:/static -p 3000:3000 --security-opt no-new-privileges mockoon/cli:latest -d data -p 3000
  

• Sanitize File Paths in Code:

  const path = require('path');
  const sanitizedPath = path.normalize(userInput).replace(/^(..(\/|\|$))+/, '');
  

Code Snippets:

• Input Validation:

  function validateFilePath(input) {
  const forbiddenSequences = /..\/|..\/;
  if (forbiddenSequences.test(input)) {
  throw new Error('Invalid file path');
  }
  return input;
  }
  

• Path Whitelisting:

  const allowedPaths = [bash];
  function isPathAllowed(filePath) {
  return allowedPaths.some(allowed => filePath.startsWith(allowed));
  }
  

Analytics:

• Exploit Prevalence: High in cloud environments due to misconfigured containers.
• Impact: Critical, as it allows unauthorized access to sensitive data.
• Mitigation Adoption: Low, as many developers overlook input sanitization in mock servers.
  By following these steps, developers can mitigate the risks associated with this critical vulnerability.

References:

Reported By: https://github.com/advisories/GHSA-w7f9-wqc4-3wxr
Extra Source Hub:
Undercode

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram