CVE-2018-16474: Stored Cross-Site Scripting in tianma-static
Summary
CVE-2018-16474: Stored Cross-Site Scripting in tianma-static. Affects tianma-static versions < 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tianma-static package is an npm package used for serving static files. It allows users to serve files with custom names. This package is vulnerable to stored cross-site scripting (XSS) attacks, which can be exploited when a user can control the name of a file served by tianma-static.
Vulnerability Detail
The stored cross-site scripting vulnerability in tianma-static allows an attacker to inject malicious scripts into files served by the package. When a user requests a file with a specially crafted name, the injected script will be executed in the context of other users accessing the file. This can lead to various security issues, such as stealing sensitive information or performing actions on behalf of the user.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, the best workaround is to switch to a different static file server that is not vulnerable to stored cross-site scripting.
Conclusion
The tianma-static package is vulnerable to stored cross-site scripting (XSS), which can be exploited by controlling the name of a file served by the package. As no fix is available at this time, it is recommended to switch to an alternative static file server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tianma-static →
FAQ
Stored cross-site scripting (XSS) is a type of web vulnerability where an attacker injects malicious scripts into a website or web application. These scripts are then executed by other users accessing the affected pages, potentially leading to unauthorized actions or data theft.
An attacker can exploit this vulnerability by controlling the name of a file served by tianma-static and injecting malicious scripts into it. When other users access the file, the injected scripts will be executed in their browsers, allowing the attacker to perform various malicious actions.
The consequences of this vulnerability can vary depending on the attacker's intentions. Possible consequences include stealing sensitive information, performing actions on behalf of the user, defacing the website, or spreading malware to other users.
No, there is currently no fix available for this vulnerability. It is recommended to switch to a different static file server that does not have this vulnerability.
Yes, all versions of tianma-static up to and including version 1.0.4 are affected by this vulnerability.
