Crafatar path traversal vulnerability

Vulnerability

Crafatar 2.1.4 and earlier contains a path traversal vulnerability in its asset_request function, located in lib/server.js. The server uses url.parse() on the incoming request URL without resolving path sequences, then joins the path with the lib/public/ directory when reading files. This allows an attacker to include ../ sequences to escape the intended public directory and read arbitrary files on the filesystem [2][3].

Exploitation

An attacker can exploit this by sending a crafted HTTP GET request to the Crafatar server with a path containing ../ sequences, such as curl https://example.com/../server.js --path-as-is [3]. No authentication or special privileges are required, and the server must not be behind a reverse proxy like Cloudflare that blocks path traversal attempts [3].

Impact

On success, an attacker can read any file that the Crafatar process has read access to, including server-side source code, configuration files, and potentially sensitive data. In the default Docker container deployment, the attacker is limited to files within the container, which are not confidential by default [3]. However, instances not using Docker could expose more sensitive host files.

Mitigation

This vulnerability is patched in Crafatar version 2.1.5, released on 2024-02-01 [1][3]. Users should upgrade to 2.1.5 or later immediately [3]. Instances behind Cloudflare are not affected because Cloudflare blocks path traversal attempts. There is no other workaround; upgrading is the only complete mitigation [3].