Nimbus Docs: Case-Sensitive Guards and the Zero-Byte Proc File

GET /download/%2E%2E%2Fconfig.json HTTP/1.1
Host: docs.nimbus.internal

Why it survives every layer:

1. The guard inspects req.url (raw, undecoded) for .. and for lowercase %2e. %2E%2E is uppercase hex, so both substrings miss. String matching on an encoded representation is the bug: it has to fail closed on decode, not pattern-match on bytes.
2. Routing still matches /download/:name, because the encoded %2F is not a path separator to Express's router - the whole thing is one segment.
3. decodeURIComponent then turns req.params.name into ../config.json.
4. path.join(UPLOAD, '../config.json') normalises before anything else sees it: /srv/nimbus/uploads/../config.json → /srv/nimbus/config.json. Note join concatenates (it does not discard the left side the way path.resolve would), so an absolute name would have become /srv/nimbus/uploads/etc/passwd - traversal is the useful direction here.
5. sendFile receives a fully normalised absolute path with no .. left in it, so send's own dot-segment and dotfile protections have nothing to detect; without a root option they cannot apply anyway. fs.open follows the path, uid 998 owns the file → 200 with the DSN.

Note the guard is also bypassable as ..%2F only when the checker misses it - here the lowercase %2e rule covers that, which is precisely why uppercase hex is the gap. A quick sanity probe: /download/%2E%2E%2F%2E%2E%2Fetc%2Fpasswd returning 400 with the same body as a normal 404 tells you the guard fired, not that the file is missing.

/proc/self/environ - readable but useless through sendFile. Permissions are fine (0400, owned by uid 998, the app's own uid), and the payload GET /download/%2E%2E%2F%2E%2E%2Fproc%2Fself%2Fenviron resolves correctly. The failure is in send: it stats the target and sets Content-Length from st_size. Procfs files report size 0, so you get 200 OK, Content-Length: 0, and an empty body. The data only exists when read sequentially, which is not what a size-driven static sender does. Do not conclude "no secrets in env" from an empty 200 - conclude "wrong exfiltration primitive".

/proc/self/cwd is a symlink into the container filesystem. Through this endpoint it is only useful as reconnaissance: request /proc/self/cwd/package.json to confirm the app root is /app and to read package.json, .env, and any committed config relative to it. fs.open follows symlinks, so /proc/self/root/srv/nimbus/config.json also works - same file, different path, which is handy if a WAF or log rule ever keys on the literal string srv/nimbus.

Practical order of fire: config.json → /proc/self/cwd/.env → /proc/self/cwd/package.json → /proc/1/environ (the parent process, often the supervisor, and again size 0 - so instead look for a mounted .env or an app config file). The reliable lesson: procfs plus a stat-based static file server yields empty bodies; always pivot to a real on-disk file that the process can read.

replace(/[.]{2}/g,'') - broken by collapse. The replacement runs once, left to right, on the raw string. ....//config.json → ../config.json; ..././ variants behave similarly, and if you decode first you must also reason about %252e%252e%252f arriving as literal %2e%2e%2f after a single decode. Any blacklist that mutates rather than validates is a bug waiting for the next encoding trick.

path.basename(name) - safe but over-restrictive. It strips every directory component, so traversal is impossible, but the endpoint's legitimate use case (subdirectories per tenant) dies with it. It is the right choice only if flat filenames are truly the contract.

Resolved-prefix check - correct, and the one to ship:

const p = path.resolve(UPLOAD, req.params.name);
if (p !== UPLOAD && !p.startsWith(UPLOAD + path.sep)) return res.sendStatus(400);
res.sendFile(path.basename(req.params.name), {root: UPLOAD, dotfiles: 'deny'});

Details that matter:

• path.resolve normalises and collapses .., so the comparison sees the real target. startsWith(UPLOAD) without the trailing separator lets /srv/nimbus/uploads-evil pass - always append path.sep, and handle the exact-equal case separately.
• Use sendFile's own root option so the library enforces containment as well; defence in depth costs nothing here.
• Decode exactly once and validate the decoded value; never validate the encoded form.
• Add a symlink check (fs.realpath and re-test the prefix) if tenants can create symlinks inside the bucket mount.
• The guard belongs in a middleware applied to every file-serving route, not copy-pasted per handler - the same pattern almost certainly appears in the upload and thumbnail endpoints.