Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-26299

CVE-2020-26299:
File System Bounds Escape

9.6

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-26299
GHSA ID
GHSA-pmw4-jgxx-pcq9
EPSS Score
0.71995%
CWE
CWE-22
Published
2/10/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
ftp-srvnpm< 4.4.04.4.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how path resolution was handled in Windows environments. The commit 457b859 shows critical changes to the _resolvePath function in src/fs.js, including adding Windows separator replacement and improved path normalization. The original implementation didn't properly sanitize Windows-style paths before passing to path.resolve(), which preserves parent directory references (..) when using backslashes. This allowed clients to escape the root directory using commands like CWD with Windows-style path separators.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *li*nts o* *TP s*rv*rs utilizin* `*tp-srv` *ost** on Win*ows m***in*s **n *s**p* t** *TP us*r's ***in** root *ol**r usin* t** *xp**t** *TP *omm*n*s, *or *x*mpl*, `*W*` *n* `UP*R`. ### ***k*roun* W**n win*ows s*p*r*tors *xist wit*in t**

Reasoning

T** vuln*r**ility st*ms *rom *ow p*t* r*solution w*s **n*l** in Win*ows *nvironm*nts. T** *ommit ******* s*ows *riti**l ***n**s to t** `_r*solv*P*t*` *un*tion in `sr*/*s.js`, in*lu*in* ***in* Win*ows s*p*r*tor r*pl***m*nt *n* improv** p*t* norm*liz*t