CVE-2012-3521: GeSHi Directory Traversal Vulnerability
Summary
CVE-2012-3521: GeSHi vulnerable to Directory Traversal. Affects geshi/geshi versions < 1.0.8.11. Fixed in 1.0.8.11. How to fix ↓
Also tracked for
- geshi · Debian:11
The same CVE-2012-3521 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GeSHi, short for Generic Syntax Highlighter, is a widely used library for syntax highlighting in various programming languages. It is particularly popular among developers for its ease of use and flexibility. The library supports multiple languages and allows for customization of highlighting styles. However, prior to version 1.0.8.11, GeSHi's cssgen contrib module was found to be vulnerable to directory traversal attacks, which could allow unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from multiple directory traversal flaws in the cssgen contrib module of GeSHi before version 1.0.8.11. Attackers can exploit these vulnerabilities by manipulating the geshi-path or geshi-lang-path parameters to traverse directories. This could lead to unauthorized reading of arbitrary files on the server, potentially exposing sensitive information and compromising the security of the application.
How To Fix
Minimum fixed version
1.0.8.11
This is the first release that contains the fix.
composer require geshi/geshi:1.0.8.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to validate and sanitize the input for the geshi-path and geshi-lang-path parameters to prevent directory traversal attempts. Ensure that these parameters do not contain any sequences like '../' that could lead to unauthorized file access.
Conclusion
The directory traversal vulnerability in GeSHi prior to version 1.0.8.11 poses significant security risks. It is crucial for developers using this library to update to the latest version to mitigate these risks. Implementing input validation can serve as a temporary workaround while ensuring that your application remains secure.
See every vulnerability recorded for geshi/geshi →
FAQ
A directory traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized access to sensitive data.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. You can visit the Vulert playground at Vulert Scanner to analyze your composer.lock file without any signup.
The risks include unauthorized access to sensitive files, potential data leaks, and the possibility of further exploitation of the system by attackers.
Yes, you can implement input validation and sanitization for the geshi-path and geshi-lang-path parameters to prevent directory traversal attempts as a temporary measure.
If you suspect a compromise, immediately review your logs for unauthorized access, update your packages, and consider conducting a security audit of your application.
Related vulnerabilities
Recent vulnerabilities recorded for geshi/geshi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.