Mitigate TOCTOU path traversal and symlink attacks in disk/index.js

[zeropath-ai-staging]

Summary

Serving files based on user-supplied names allows reading arbitrary files due to a Time-of-Check/Time-of-Use (TOCTOU) race condition. The code in disk/index.js (lines 8-14) resolves the requested filename and checks if it begins with the application's directory, but a symlink swap after the check and before the file read may bypass this control. This allows an attacker to potentially read sensitive files outside of the intended directory. Additionally, returning raw fs error messages to the client may leak internal filesystem details.

Vulnerability Details

• Vulnerability Class: Path Traversal / TOCTOU race and information disclosure
• Severity: 7.0
• Affected File: disk/index.js
• Vulnerable Lines: 8-14

Code Snippets

diff --git a/disk/index.js b/disk/index.js
--- a/disk/index.js
+++ b/disk/index.js
@@ -6,12 +6,52 @@
 // Path Traversal
 app.get('/read', (req, res) => {
   const file = req.query.file;
+  if (!file || typeof file !== 'string') return res.status(400).send('Invalid file');
   const fullPath = path.resolve(__dirname, file);
-  if (!fullPath.startsWith(__dirname + path.sep)) return res.status(400).send('Invalid file path');
-  fs.readFile(fullPath, 'utf8', (err, data) => {
-    if (err) return res.status(500).send(err.message);
-    res.send(data);
-  });
+  // Ensure the resolved path is inside the application directory
+  if (!fullPath.startsWith(__dirname + path.sep) && fullPath !== __dirname) return res.status(400).send('Invalid file path');
+
+  // Prefer O_NOFOLLOW to avoid following symlinks at open time (mitigates TOCTOU symlink swap).
+  // If O_NOFOLLOW isn't available on the platform, fall back to lstat-based check and reject symlinks.
+  const hasONoFollow = fs.constants && (typeof fs.constants.O_NOFOLLOW !== 'undefined');
+  const openFlags = hasONoFollow ? (fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW) : fs.constants.O_RDONLY;
+
+  const finishWithFd = (fd) => {
+    fs.readFile(fd, 'utf8', (err, data) => {
+      fs.close(fd, () => {});
+      if (err) {
+        console.error(err);
+        return res.status(500).send('Unable to read file');
+      }
+      res.send(data);
+    });
+  };
+
+  if (hasONoFollow) {
+    fs.open(fullPath, openFlags, (err, fd) => {
+      if (err) {
+        console.error(err);
+        return res.status(400).send('Invalid file path');
+      }
+      finishWithFd(fd);
+    });
+  } else {
+    // Fallback: reject if the path is a symlink (reduces TOCTOU window on platforms without O_NOFOLLOW)
+    fs.lstat(fullPath, (err, stats) => {
+      if (err) {
+        console.error(err);
+        return res.status(400).send('Invalid file path');
+      }
+      if (stats.isSymbolicLink()) return res.status(400).send('Invalid file path');
+      fs.open(fullPath, openFlags, (err, fd) => {
+        if (err) {
+          console.error(err);
+          return res.status(400).send('Invalid file path');
+        }
+        finishWithFd(fd);
+      });
+    });
+  }
 });
 
 app.listen(3001, () => console.log('Disk vuln on port 3001'));

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai!

To request modifications, please post a comment beginning with @zeropath-ai and specify the changes required.

@zeropath-ai will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_7e2e040d

# if vscode is installed run (or use your favorite editor / IDE):
code disk/index.js

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_7e2e040d