CVE-2016-10529: Cross-Site Socket Forgery in droppy
Summary
CVE-2016-10529: No CSRF Validation in droppy. Affects droppy versions < 3.5.0. Fixed in 3.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Droppy is an npm package that provides a file-sharing server with a web interface. It allows users to upload, download, and manage files through a web browser. The package is vulnerable to a cross-site socket forgery (CSRF) attack, which occurs when an attacker tricks a user's browser into making unintended requests to a target website. In this case, droppy does not perform proper verification for cross-domain websocket requests, allowing an attacker to create a web page that opens a websocket connection on behalf of the user. This vulnerability can lead to unauthorized actions, such as adding a new admin account or deleting existing accounts.
Vulnerability Detail
The vulnerability in droppy arises from the lack of CSRF validation for cross-domain websocket requests. By exploiting this vulnerability, an attacker can create a malicious web page that establishes a websocket connection on behalf of a user visiting the page. This allows the attacker to perform actions as if they were the target user, including adding a new admin account under their control or deleting other accounts. The impact of this vulnerability can be severe, as it grants unauthorized access and control over the droppy file-sharing server.
How To Fix
Minimum fixed version
3.5.0
This is the first release that contains the fix.
npm install droppy@3.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in droppy allows for cross-site socket forgery (CSRF) attacks, enabling unauthorized actions on the file-sharing server. To mitigate this vulnerability, it is crucial to update droppy to version 3.5.0 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for droppy →
FAQ
Droppy is an npm package that provides a file-sharing server with a web interface. It allows users to upload, download, and manage files through a web browser.
Cross-site socket forgery (CSRF) is an attack that tricks a user's browser into making unintended requests to a target website. In the case of droppy, it allows an attacker to perform actions on the file-sharing server as if they were the target user.
By exploiting this vulnerability, an attacker can add a new admin account under their control or delete existing accounts on the droppy file-sharing server.
To protect your droppy installation, it is recommended to update the package to version 3.5.0 or later, which includes the necessary CSRF validation for cross-domain websocket requests.
No specific workaround is mentioned for this vulnerability. It is advised to update the package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for droppy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
