Sonya Moisset

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Are you decoding URLs before or after normalizing paths? The wrong order can expose every file on your Node.js server.

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks
#1about 3 minutes

Defining path traversal and its severe impact

Path traversal is a vulnerability where attackers exploit insufficient validation of user-supplied file names to access restricted files, leading to information exposure and vulnerability chaining.

#2about 3 minutes

Examining high-impact path traversal exploits in the wild

Major software like Zimbra and Apache HTTP Server have suffered from critical, unauthenticated path traversal vulnerabilities leading to widespread system compromise.

#3about 7 minutes

How URL encoding bypassed security in the `st` package

Attackers bypassed path normalization in the popular `st` NPM package using URL-encoded characters, a vulnerability fixed by first decoding the URI component and then normalizing the path.

#4about 5 minutes

Exfiltrating local files via a VS Code extension

The "Open in Default Browser" VS Code extension contained a path traversal flaw that allowed attackers to trick users into exfiltrating local files like SSH keys.

#5about 4 minutes

A critical path traversal flaw in the Node.js runtime

A specific version of the Node.js runtime had an improper path sanitization issue that made applications vulnerable to directory traversal by default.

#6about 3 minutes

Key takeaways and tools for preventing path traversal

Path traversal is an omnipresent risk that can be mitigated by understanding API function order and using automated security scanning tools directly in your IDE.

Related jobs
Jobs that call for the skills explored in this talk.

Job ad Dark

SabIna compys

SabIna compys
Vienna, Austria

Remote
€20-100K
Intermediate
JavaScript
.NET
+1

Matching moments

How attackers exploit developers and packages
05:43 MIN

How attackers exploit developers and packages

Vue3 practical development

Common attacks targeting software developers
05:49 MIN

Common attacks targeting software developers

Vulnerable VS Code extensions are now at your front door

How developers can become malware distribution vehicles
02:39 MIN

How developers can become malware distribution vehicles

Stranger Danger: Your Java Attack Surface Just Got Bigger

Exploring specific web vulnerabilities and filtering issues
03:17 MIN

Exploring specific web vulnerabilities and filtering issues

WeAreDevelopers LIVE - Chrome for Sale? Comet - the upcoming perplexity browser Stealing and leaking

Developers as an unintentional malware distribution vehicle
03:36 MIN

Developers as an unintentional malware distribution vehicle

Walking into the era of Supply Chain Risks

Why developers are a prime target for attackers
04:54 MIN

Why developers are a prime target for attackers

You click, you lose: a practical look at VSCode's security

Taking action on NPM supply chain security vulnerabilities
05:36 MIN

Taking action on NPM supply chain security vulnerabilities

WeAreDevelopers LIVE - Build a multi AI agents game master with Strands & our weekly web finds

Introduction to developer-first security and CTFs
04:09 MIN

Introduction to developer-first security and CTFs

Capture the Flag 101

Featured Partners

Related Videos

See all videos
You click, you lose: a practical look at VSCode's security29:47

You click, you lose: a practical look at VSCode's security

Thomas Chauchefoin & Paul Gerste

Vulnerable VS Code extensions are now at your front door44:11

Vulnerable VS Code extensions are now at your front door

Raul Onitza-Klugman & Kirill Efimov

101 Typical Security Pitfalls28:41

101 Typical Security Pitfalls

Alexander Pirker

Security in modern Web Applications - OWASP to the rescue!26:59

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

Walking into the era of Supply Chain Risks37:36

Walking into the era of Supply Chain Risks

Vandana Verma

Oops! Stories of supply chain shenanigans43:57

Oops! Stories of supply chain shenanigans

Zbyszek Tenerowicz

Friend or Foe? TypeScript Security Fallacies27:41

Friend or Foe? TypeScript Security Fallacies

Liran Tal

Stranger Danger: Your Java Attack Surface Just Got Bigger1:58:59

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Related Articles

View all articles
CH
Chris Heilmann
Dev Digest 138 - Are you secure about this?
Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of security. Enjoy! News and ArticlesGoogle Pixel phones t...
Dev Digest 138 - Are you secure about this?
CH
Chris Heilmann
Dev Digest 110 - XY marks the spotty security
This time we give you a collection of links about the XZ backdoor, solve the last CODE100 puzzle, announce the next round of it, let you play with colours and explain why Lava lamps are great to keep the web secure.News and ArticlesThe big piece of n...
Dev Digest 110 - XY marks the spotty security
Dev Digest 105 - Security First
Last Friday's Dev Digest was mostly about security and game topics, so let's take a look what you didn't get in your inbox. We also covered some brand new online courses to get started as a developer or refresh your knowledge. And we wrapped up CODE1...
Dev Digest 105 - Security First
CH
Chris Heilmann
Dev Digest 136 - No JS(on) of mine
News and ArticlesDouglas Crockford is our featured video, so let's talk about evolving JavaScript and all things JSON. Judicious JSON explains all the weird things in it, you can learn why it can be incredibly slow, people wonder what even is a JSON ...
Dev Digest 136 - No JS(on) of mine

From learning to earning

Jobs that call for the skills explored in this talk.