Attack Chain

1. Attacker identifies a target application using image-downloader that accepts user-supplied URLs for image processing.
2. Attacker hosts a malicious server or redirects a request to a controlled URL path.
3. Attacker crafts a URL path containing percent-encoded traversal sequences (e.g., /%2e%2e%2f%2e%2e%2fetc/passwd).
4. The vulnerable image-downloader package calls path.basename() on the encoded path, which fails to strip the traversal sequences because they contain no literal slashes.
5. The library calls decodeURIComponent(), resolving the percent-encoded sequences into literal ../ traversal strings.
6. path.join() concatenates the destination directory and the decoded traversal, resulting in a write operation outside the restricted directory.
7. The application writes the content from the attacker-controlled URL to the chosen target path on the host filesystem.

Impact

Successful exploitation allows for arbitrary file writes on the host system. Depending on the environment and filesystem permissions, this can lead to remote code execution by overwriting configuration files, startup scripts, or authentication-related files such as .ssh/authorized_keys.

Recommendation

• Upgrade image-downloader to version 4.3.1 or later immediately.
• Audit applications utilizing the image-downloader library to ensure that user-supplied URLs are strictly validated or passed through a blocklist of traversal characters before processing.
• Implement filesystem sandboxing or run processes with the principle of least privilege to limit the impact of potential arbitrary file write vulnerabilities.