CVE-2016-1000249: Arbitrary File Read Vulnerability in fury-adapter-swagger
Summary
CVE-2016-1000249: fury-adapter-swagger allows arbitrary file read from system. Affects fury-adapter-swagger versions >= 0.2.0, < 0.9.7. Fixed in 0.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fury-adapter-swagger is an npm package that provides an adapter for generating Swagger documentation from Fury API descriptions. It allows users to easily generate Swagger documentation for their APIs. The package is widely used in Node.js applications that utilize Swagger for API documentation.
Vulnerability Detail
The fury-adapter-swagger package, from version 0.2.0 to 0.9.7, is vulnerable to arbitrary file read. This vulnerability allows an attacker to read arbitrary files from the system, potentially exposing sensitive data. An attacker can exploit this vulnerability by sending a specially crafted request to the affected application, causing it to read and return the contents of arbitrary files on the server. This can lead to information disclosure or even a denial of service if critical system files are accessed. An example proof of concept is provided in the vulnerability details.
How To Fix
Minimum fixed version
0.9.7
This is the first release that contains the fix.
npm install fury-adapter-swagger@0.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the package to mitigate the risk.
Conclusion
The fury-adapter-swagger package is vulnerable to arbitrary file read, which can lead to information disclosure or denial of service. It is crucial to upgrade to version 0.9.7 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fury-adapter-swagger →
FAQ
fury-adapter-swagger is an npm package that provides an adapter for generating Swagger documentation from Fury API descriptions.
This vulnerability allows an attacker to read arbitrary files from the system, potentially exposing sensitive data or causing a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for open-source vulnerabilities in real-time.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the package.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-2r7f-4h2c-5x73/GHSA-2r7f-4h2c-5x73.json
