# Fix for CVE-2021-22151 (Kibana path traversal issue) can be bypassed on Windows

Incomplete fix for CVE-2021-22151 in Kibana's maps font route allows Windows path traversal via drive-letter prefix, disclosing arbitrary .pbf files.

- Payout: hidden
- Severity: low
- Program: Elastic
- Found by: dee-see
- Disclosed: 2021-11-15
- CVE: CVE-2021-22151
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1353603
- Library page: https://bugbountylibrary.com/r/h1%3A1353603
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:low tech:nodejs tech:windows technique:incomplete-fix technique:source-review vuln:info-disclosure vuln:path-traversal

**Target:** Kibana maps plugin font-serving API endpoint
**Root cause:** Fix normalized the range param and only rejected values starting with '..', but on Windows a drive-letter prefix like 'c:../../..' normalizes to 'c:..\..' which doesn't start with '..' yet still traverses when joined.
**Steps:**
1. Place a test file: `echo hax > c:\path_traversal.pbf` on a Windows host running Kibana
2. Request `GET /api/maps/fonts/open_sans/c%3A..%2F..%2F..%2F..%2F..%2F..%2F..%2Fpath_traversal`
3. Add extra `..%2f` segments depending on Kibana install depth
4. Observe the arbitrary .pbf file is returned
**How found:** Reviewing the GitHub fix for CVE-2021-22151 and noticing the startsWith('..') check assumes POSIX normalization; tested path.normalize with a drive-letter prefix in Node REPL on Windows and saw it bypass the check.
**Exploitation:** Attacker sends a crafted range path with a Windows drive-letter prefix and encoded traversal sequences to the maps font endpoint, causing path.join to resolve outside the fonts directory and read arbitrary .pbf files.
**Insight:** When auditing path-traversal fixes, check whether the sanitization assumes POSIX semantics; Windows drive-letter prefixes (c:..) and backslash separators defeat startsWith('..') checks. Verify fixes by resolving the final path and confirming containment rather than string-prefix checks.