Char Wars: The Path Traversal Strikes Back
summary
Demonstrates real path‑traversal cases: a vulnerable npm middleware st npm (≈500k weekly downloads) where percent‑encoded “..” bypasses normalize before decode, a VS Code extension open in default browser extension that spins a local server and exfiltrates a keys.txt file, and an old Node.js core bug (v8.5.0 era) that made path.resolve/normalize unsafe. Uses the automated scanner dotdotpwn to find workable encodings, shows successful reads of /etc/hosts and server.js, and points to the practical fix: decode then normalize.
AI-written summary · about
chapters (8)
- 0:00Introduction to path traversal
- 3:56What is path traversal
- 8:13Secure coding basics
- 8:36Vulnerable npm package SD
- 14:36VS Code extension attack
- 19:35Node.js runtime vulnerability
- 25:42Staying updated on security
- 26:03Summary and takeaways
related talks
25mThe Path Traversal Strikes Back - Liran Tal
24mWriting Secure JavaScript
47mNode.js Security: Breaking The Loop
47mLive Hacking: Breaking into Your Web App
41mLive Hacking: Breaking into Your Web App
29mA Node.js Security Roadmap
51mStranger Danger: Your Node.js Attack Surface Just Got Bigger
55mNode.js Security: Breaking The Loop