CVE-2017-16036: Directory Traversal in badjs-sourcemap-server
Summary
CVE-2017-16036: Directory Traversal in badjs-sourcemap-server. Affects badjs-sourcemap-server versions < 0.1.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The badjs-sourcemap-server is an npm package used for local development. It provides functionality to resolve relative file paths. However, versions prior to 0.1.11 are vulnerable to a directory traversal vulnerability. This vulnerability allows a malicious actor to access files outside of the intended directory root, potentially leading to the disclosure of private files on the vulnerable system.
Vulnerability Detail
The directory traversal vulnerability in badjs-sourcemap-server arises from the improper resolution of relative file paths. By exploiting this vulnerability, an attacker can craft a malicious request to access files outside of the intended directory root. For example, an attacker can send a GET request with a crafted path like GET /../../../etc/passwd to retrieve sensitive system files. This can result in the unauthorized disclosure of private information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the best workaround is to avoid using the badjs-sourcemap-server package in production environments. Instead, consider using an alternative package that provides similar functionality but does not suffer from the directory traversal vulnerability.
Conclusion
The badjs-sourcemap-server package has a directory traversal vulnerability that allows unauthorized access to sensitive files. It is crucial to avoid using this package in production environments and switch to a more secure alternative. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for badjs-sourcemap-server →
FAQ
The vulnerability allows an attacker to access sensitive files outside of the intended directory root, potentially leading to the disclosure of private information.
No, there is no patch available for this vulnerability at the moment.
Yes, this vulnerability can be exploited remotely by sending crafted requests to the vulnerable server.
No, only versions prior to 0.1.11 are affected by this vulnerability.
If you are using badjs-sourcemap-server, it is recommended to only use it for local development purposes. For production environments, switch to a different package that does not have this vulnerability.
