CVE-2018-1000023: Full Path Disclosure in insight-api
Summary
CVE-2018-1000023: Insight API transaction broadcast endpoint can result in Full Path Disclosure. Affects insight-api versions < 5.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
insight-api is an npm package that provides an API for interacting with the Bitpay/insight blockchain explorer. It allows users to retrieve information about transactions, blocks, and addresses on the blockchain. This package is vulnerable to a CWE-20: input validation vulnerability in the transaction broadcast endpoint. This vulnerability can result in Full Path Disclosure, where an attacker can obtain sensitive information about the server's file system. The vulnerability affects insight-api versions 5.0.0 and earlier.
Vulnerability Detail
The vulnerability in insight-api's transaction broadcast endpoint allows an attacker to exploit the application through a web request. By manipulating the input, an attacker can cause the application to disclose the full path of the server's file system. This information can be used to gain further knowledge about the server's configuration and potentially launch more targeted attacks. The impact of this vulnerability is considered moderate.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to ensure that all user input is properly validated and sanitized before being processed by the application. This can help mitigate the risk of input validation vulnerabilities.
Conclusion
The insight-api package, specifically versions 5.0.0 and earlier, is vulnerable to a Full Path Disclosure vulnerability. This can allow an attacker to obtain sensitive information about the server's file system. To mitigate this vulnerability, it is important to upgrade to a non-affected version of the package and ensure proper input validation and sanitization in the application. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for insight-api →
FAQ
insight-api is an npm package that provides an API for interacting with the Bitpay/insight blockchain explorer. It allows users to retrieve information about transactions, blocks, and addresses on the blockchain.
Full Path Disclosure is a vulnerability where an application reveals the full path of its file system to an attacker. This information can be used to gain knowledge about the server's configuration and potentially launch more targeted attacks.
This vulnerability can be exploited by sending a specially crafted web request to the transaction broadcast endpoint of the insight-api. By manipulating the input, an attacker can cause the application to disclose the full path of the server's file system.
The impact of this vulnerability is considered moderate. While it does not directly allow for remote code execution or unauthorized access, it can provide valuable information to an attacker, which can be used to plan further attacks.
To fix this vulnerability, it is recommended to upgrade to a version of insight-api that is not affected by this issue. Developers should update their package.json file to specify a version that is higher than 5.0.0 and run the package manager's install command to fetch the latest version of the package and its dependencies.
