CVE-2024-56198

Executive Summary

CVE-2024-56198 is a path traversal vulnerability in the path-sanitizer npm package, versions prior to 3.1.0. The package is designed to sanitize user-supplied paths to prevent directory traversal attacks. However, due to insufficient filtering of URL-encoded characters, an attacker can bypass the sanitization by using =%5c (which decodes to a backslash \). This allows an attacker to traverse directories outside the intended root, potentially reading sensitive files on the server.

Supply Chain & Package Security

This vulnerability affects the npm package path-sanitizer. As an open-source dependency, it can be introduced into applications via package.json or npm install. Organizations using this package should immediately audit their dependencies and update to version 3.1.0. The package is lightweight and commonly used in Node.js applications for path validation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but based on analysis, a more realistic score is 7.5 (High).
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: High – Exploitation is trivial and can lead to unauthorized file disclosure.

Deep Dive & Mechanics

The path-sanitizer package uses a filter to remove or block path traversal sequences like ../ or ..\. However, the filter does not account for URL-encoded representations. Specifically, the sequence =%5c is not recognized as a backslash (\). When a user supplies a path like ..=%5c..=%5cetc=%5cpasswd, the sanitizer fails to block it because it sees =%5c as a literal string, not a backslash. After the sanitization step, the path is decoded, and the backslash becomes effective, allowing traversal.

The vulnerability is in the regex or string matching logic that only checks for literal backslashes or dots, not their URL-encoded equivalents.

Vulnerable vs. Patched Code

Vulnerable (prior to 3.1.0):

function sanitize(input) {
  // Only checks for literal backslash
  if (input.includes('..\\') || input.includes('../')) {
    return 'blocked';
  }
  return input;
}

Patched (3.1.0):

function sanitize(input) {
  // Decode URL-encoded characters first
  const decoded = decodeURIComponent(input);
  if (decoded.includes('..\\') || decoded.includes('../')) {
    return 'blocked';
  }
  return input;
}

The patch adds a decodeURIComponent() call before the traversal check, ensuring that encoded backslashes (%5c) are detected.

Exploitation & Lab Setup

Red Team

Exploit Code:

import requests

target = "http://target.com/vulnerable-endpoint"
payload = "..=%5c..=%5cetc=%5cpasswd"
url = f"{target}?file={payload}"

response = requests.get(url)
print(response.text)

Explanation: The payload ..=%5c..=%5cetc=%5cpasswd is URL-encoded. When the server receives it, the path-sanitizer does not block it because it sees =%5c as a literal. After sanitization, the path is decoded, resulting in ..\..\etc\passwd, which traverses to the /etc/passwd file.

Blue Team

Lab Setup:

1. Deploy a Node.js application using path-sanitizer version 3.0.0.
2. Create an endpoint that accepts a file parameter and uses the package to sanitize it.
3. Simulate the attack by sending the payload.
4. Monitor logs for unusual file access patterns.

Detection: Look for requests containing %5c in the query string or body, especially in combination with .. sequences.

Indicators of Compromise (IOCs)

• Network: HTTP requests with %5c in the path or query string.
• File System: Unauthorized access to files like /etc/passwd, C:\Windows\win.ini, etc.
• Logs: Error logs showing file not found or permission denied for paths outside the web root.
• Process: Node.js processes reading files outside the intended directory.

Detection Engineering

YARA Rule

rule CVE_2024_56198_Path_Traversal {
  meta:
    description = "Detects path traversal attempts using URL-encoded backslash in path-sanitizer"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2024-56198"
  strings:
    $encoded_backslash = "%5c"
    $path_traversal = ".."
  condition:
    any of ($encoded_backslash) and any of ($path_traversal)
}

Sigma Rule

title: CVE-2024-56198 Path Traversal via URL-Encoded Backslash
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with %5c and .. indicating path traversal
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-uri-query|contains: '%5c'
    cs-uri-query|contains: '..'
  condition: selection
falsepositives:
  - Legitimate use of %5c in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56198 Path Traversal Attempt"; flow:to_server; content:"%5c"; http_uri; content:".."; http_uri; distance:0; within:10; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade path-sanitizer to version 3.1.0 or later.
2. Workaround: If upgrade is not possible, implement additional input validation to decode URL-encoded characters before sanitization.
3. Long-term: Use a more robust path validation library like path module in Node.js with path.resolve() and ensure the resolved path stays within the intended root.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.
5. Audit: Review all dependencies for similar vulnerabilities.

Valters IT