GHSA-2g9m-gh52-f39v: 
JavaScript vulnerability analysis and mitigation

Summary

Two file-disclosure defects affect koa-static-resolver 1.0.1–1.0.6: shared mutable defaults can cause one middleware mount to serve another mount's directory, and a symlink under a static root can expose its target outside that root. Both were fixed in 1.0.7. These findings are distinct from the Windows URL-encoded backslash traversal covered by GHSA-87xr-4xf6-qw8c.

Details

Cross-mount disclosure (CWE-668)

The affected implementation uses Object.assign(defaultOptions, options), mutating module-level defaults and retaining the same options object across middleware instances. Constructing a later mount can replace the root of an earlier mount. A request to a public mount can therefore return files from a directory intended for a separate private mount, without reaching that mount's route-level authorization. Multiple instances from the same loaded module are required. Omitted options retain earlier values; explicit options overwrite them.

External-symlink reads (CWE-59)

The affected implementation follows symlinks under a configured static root without checking real-path containment. A single mount can serve a target outside the root when a resolvable symlink exists and the Node.js process can read its target. This does not require Windows, encoded backslashes, or multiple mounts. It is not unrestricted host-file access or remote code execution.

Affected versions and remediation

Affected versions: 1.0.1 through 1.0.6. First patched version: 1.0.7 (not 1.1.0). Repository tags 1.0.1–1.0.6 were source-inspected; the existing reproductions compare 1.0.6 and 1.0.7. Earlier releases are not established as affected by this record. Upgrade to 1.0.7 or later, preferably the latest stable release. The fix creates a separate options object per instance and checks lexical and real-path containment for requested files and default indexes. Until upgraded, avoid multiple instances with sensitive roots and remove external symlinks. Construction order is not a reliable mitigation. Keep served paths read-only to untrusted users; containment checks are not atomic with opening files and do not eliminate concurrent replacement races. Fix: https://github.com/cenfun/koa-static-resolver/commit/e52ef221ec4db88883588082f4c81301e0828ce0 Patched release: https://www.npmjs.com/package/koa-static-resolver/v/1.0.7

Credit

Finder for both defects: Ali AlMousa (contact@alialmousa.sa), GitHub @AliAAlMousa. The reporter dates the original report to 21 October and requested a separate advisory and Finder credit. This advisory does not alter bp0lr's credit for the Windows traversal finding. Sharing a fix commit does not establish duplicate discovery. The proposed severity assumes exposure of sensitive files readable by the service. Please review the scope, severity and whether separate CVE records are needed for these distinct defects.

Proof of concept

Use only synthetic canary files.

Cross-mount disclosure

1. Create separate public/ and private/ directories with public/hello.txt containing PUBLIC-OK and private/report.txt containing PRIVATE-REPORT.
2. In the same Node.js process, load koa-static-resolver once and construct the public resolver first, then the private resolver:

const KSR = require('koa-static-resolver');
const publicStatic = KSR({ dirs: ['./public'] });
const privateStatic = KSR({ dirs: ['./private'] });

3. Route /internal/ to privateStatic after stripping the prefix; route other requests to publicStatic. If the private route requires authentication, apply it before invoking privateStatic.
4. Request /report.txt through the public route: 1.0.6 returns PRIVATE-REPORT; 1.0.7 returns 404. /hello.txt returns 404 on 1.0.6 and PUBLIC-OK on 1.0.7. An authorized /internal/report.txt request returns PRIVATE-REPORT on both. A nonexistent filename returns 404 on both.

External-symlink reads

1. Create public/ok.txt containing INSIDE-OK and a sibling outside.txt containing OUTSIDE-THE-ROOT.
2. Create public/link.txt -> ../outside.txt on a system permitting symlink creation. Repeat with an absolute symlink to the same canary.
3. Serve public/ using one resolver and request /link.txt: 1.0.6 returns OUTSIDE-THE-ROOT; 1.0.7 returns 404. /ok.txt returns INSIDE-OK on both. Regression coverage: test/reported-disclosures.test.js and test/security-attacks.test.js.

Impact

Network-accessible file disclosure. Applications using multiple resolver instances may expose private-root content through another mount because configuration is shared. Applications with symlinks under a static root may expose external targets readable by the service. Confidentiality impact depends on the mounted directories, existing links and filesystem permissions. Neither defect requires Windows; no integrity or availability impact is asserted.