The Path Traversal Strikes Back - Liran Tal

on YouTube ↗25m

" summary

ChatGPT-generated upload code contains an exploitable path-traversal that lets uploads overwrite files; a popular npm module sd is shown vulnerable because decoding happens after path normalization and the fix is to decode then normalize; a VS Code extension “open in default browser” combined with ngrok and a local web server lets attackers exfiltrate keys from a developer machine; an automated tool dotdotpwn finds a live traversal in minutes; even old Node runtimes (node 0.8x) normalize paths incorrectly.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 5:53Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
3. 13:37Open in Default Browser, A VS Code extension
4. 17:52Path traversal in the Node.js runtime

" related talks

• 29mChar Wars: The Path Traversal Strikes BackLiran Tal · NodeTLV 2023
• 51mStranger Danger: Your Node.js Attack Surface Just Got BiggerLiran Tal · Voxxed Days Zürich 2022
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 29mA Node.js Security RoadmapMike Samuel · JSConf EU 2018
• 24mWriting Secure JavaScriptGuy Podjarny · JS Kongress 2016
• 47mNode.js Security: Breaking The LoopLiran Tal · jsDay 2018
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019