The Ravens’ document server opens a file from /var/www/docs by the name you type, building the path by joining the folder with your name directly. On the system, /etc/passwd reveals the server’s accounts.
The Ravens document server opens a file from var/www/docs by the name you type, showing the path it read and the content. There is no check that the name stays inside the folder, so climb-up segments walk out to system files.
Escape the documents folder and read /etc/passwd.
You escaped the documents folder and read /etc/passwd.
Why the solution worked
This is path traversal: your name went into building the file path, so ../ climbed out of the intended folder to any file the server can read. The fix: do not build a path from user input; treat the name as a file name only (take just its last segment), resolve the final path, then check it is still inside the allowed folder after resolution, and reject any name containing / or ..
The root cause
The server joins the user name onto the base folder and reads the result with no check that the final path is still inside the folder, so climb-up segments escape it.
How the code is fixed
Take just the file name, resolve the path, then confirm it is inside the allowed folder after resolution, not before.
Vulnerable code
app.get('/open', (req, res) => {
// User name joined straight onto the base: ../ climbs out.
res.send(fs.readFileSync('/var/www/docs/' + req.query.name, 'utf8'));
});
Safe code
import path from 'node:path';
app.get('/open', (req, res) => {
const base = '/var/www/docs';
const full = path.resolve(base, path.basename(req.query.name)); // only the file name
if (!full.startsWith(base + path.sep)) return res.status(400).end(); // stay inside base
res.send(fs.readFileSync(full, 'utf8'));
});
Impact in the real world
Path traversal reads sensitive files — configs, private keys, credentials — and can lead to code execution when certain files are read.
How defenders detect it
Defenders watch inputs for climb-up segments, resolve the final path, and confirm it starts with the base folder before reading.
