New Study Reveals Vulnerable Code Pattern Putting GitHub Projects at Risk of Path Traversal Attacks

A comprehensive research study has identified a widespread path traversal vulnerability (CWE-22) affecting 1,756 open-source GitHub projects, some of which are highly influential in the software ecosystem.

The vulnerability, present in a commonly used Node.js code pattern for creating static HTTP file servers, enables attackers to access files outside of restricted locations, potentially compromising confidentiality and availability of affected systems.

Widespread Path Traversal Vulnerability

The vulnerability stems from a pattern where developers use the path.join function with user-supplied input from URL pathnames without proper sanitization.

This allows attackers to exploit the pattern by using directory traversal sequences like “../” to access files outside intended directories.

According to the Report, many of the affected projects have critical vulnerabilities with CVSS scores higher than 9.0, as they can be exploited remotely without privileges.

The vulnerable code pattern first emerged around 2010 and has since propagated through popular developer resources, including GitHub Gist, Stack Overflow posts with hundreds of thousands of views, and even educational materials.

Despite developers occasionally raising security concerns about this pattern over the years, the vulnerability continued to spread due to misconceptions about its safety.

Many developers incorrectly assumed the code was secure after testing with standard HTTP clients like browsers or curl, which normalize URLs by default, masking the vulnerability.

“Unfortunately, since developers frequently reuse code from their own or external code resources, some nearly identical vulnerabilities exist across many open-source projects,” note the researchers.

This replication effect significantly increases risk, as attackers who discover one instance can potentially target numerous projects.

To conduct this large-scale study, researchers developed an automated pipeline that scans GitHub for the vulnerable pattern, confirms exploitability through static analysis and dynamic testing, assesses impact by calculating CVSS scores, generates patches using GPT-4, and reports vulnerabilities to maintainers.

Through responsible disclosure efforts, 14% of reported vulnerabilities have been remediated so far.

The researchers employed a staged notification approach, privately contacting maintainers of popular projects while using public issues and pull requests for less prominent repositories.

However, response rates varied significantly, with more popular projects showing a 42% remediation rate compared to just 11% for those receiving pull requests.

LLMs Perpetuating Vulnerable Code Patterns

Perhaps most concerning is the discovery that the widespread presence of this vulnerable code pattern has “poisoned” several popular large language models.

When prompted to create static file servers, 95% of code samples generated by tested LLMs contained the path traversal vulnerability.

Even when explicitly asked to create “secure” file servers, 70% of generated code remained vulnerable, demonstrating how these models propagate security flaws from their training data.

“Our study highlights the urgent need to help secure the open-source ecosystem by leveraging scalable automated vulnerability management solutions and raising awareness among developers,” conclude the researchers.

The findings underscore the cascading security risks that can emerge when vulnerable code patterns propagate through developer communities and into AI code generation tools, creating a persistent cycle of vulnerability replication that proves difficult to break.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!