bkind (Community Member) asked a question.
we have a node application.
in many places where we have code like
app.get('/api/endpoint', (req, res) => {
...
res.send(someData);
}
veracode is flagging CWE 73 on the res.send with:
Attack Vector: AWS.Request.send
Description: This call to AWS.Request.send() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any.
this is confusing because
- this is unrelated to aws, as far as i can tell
- res.send is dictating what is in the response, not the request input, and the argument is not a filename
should these just be false positives? is there something i am missing?
.png){kind=logo}
Hi @bkind (Community Member),
Thanks for your question.
CWE-73 relates to external control of file name or path vulnerabilities. Veracode likely raised this flaw because untrusted data (someData) was passed to send() which we understood could be used, possibly within the AWS API when constructing file names or paths. You may wish to have a look at our Community article on CWE-73: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java to understand this vulnerability further.
Regardless of whether or not send() is doing any file-based operations, you may wish to consider adding in validation of the untrusted data (someData) if you do not already have any in place. This will prevent a malicious user from interfering with what you send downstream with res.send().
If you can confirm there is validation in place and that this is not performing any file operations you may chose to propose a mitigation. However I recommend scheduling a consultation with a Veracode Application Security Consultant to discuss the specific findings further. You can find details on how to schedule a consultation here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ.
Kind regards,
Anthony Fielding
"untrusted data (someData) was passed to send() which we understood could be used, possibly within the AWS API when constructing file names or paths."
then i truly suspect this is a false positive on veracode's side, as aws is not involved at all and res.send(someData) is returning someData as the body of the http response from the api
I'm sorry to hear this could be a false positive. I would recommend you contact our technical support team. Here's how you can log a case:
In your case please mention:
Thanks,
Anthony Fielding