Internet Bug Bounty · Report #1650273
Off-by-slash vulnerability in nodejs.org and iojs.org
Summary
Misconfiguration Report for Nodejs.org
The fix linked below is to correct a nginx off-by-slash misconfiguration. While Nodejs.org is not a standard in scope asset for IBB rewards for Node.js, the intent behind the Node.js bounty program is to reward vulnerabilities that could broadly impact users of the ecosystem, therefore the high level impact of this vulnerability warranted special attention.
Thank you to Nobuhiro Nagai from N.F.Laboratories for reporting this vulnerability.
Link to pull info: https://github.com/nodejs/build/pull/2993
How it was found
Original Report: https://hackerone.com/reports/1631350 The reason for submitting this report is written in the comment of the original report.
Summary: Configuration files for Nginx in nodejs/build repository have multiple off-by-slash misconfigurations. Because nodejs.org and iojs.org are deployed using those files, it is possible for an attacker to gain access to unexpected directories. (This report is not related to nodejs/node. Therefore, I understand that this report is not eligible to Bounty.)
Description: The following files have multiple off-by-slash misconfigurations.
- https://github.com/nodejs/build/blob/main/ansible/www-standalone/resources/config/nodejs.org
- https://github.com/nodejs/build/blob/main/ansible/www-standalone/resources/config/iojs.org
For example, the following /metrics endpoint has no trailing slash, while the alias parameter has a trailing slash.
location /metrics {
alias /home/dist/metrics/;
autoindex on;
default_type text/plain;
}
The setting as above is commonly known as an off-by-slash misconfiguration.
In this case, an attacker can access files in /home/dist directory via /metrics../ endpoint.
Steps To Reproduce:
For example, you can browse the contents of /home/dist/.bashrc by accessing https://nodejs.org/metrics../.bashrc.
Impact:
If sensitive files exist in the dist user's home directory, it is possible for an attacker to view their contents.
Supporting Material/References:
Impact
An attacker can access files in the /home/dist directory of the nodejs.org and iojs.org servers.