CVE-2018-3715: Path Traversal in glance

Background

The glance package is an npm package used for image recognition and processing. It provides various functionalities for manipulating and analyzing images. However, versions of glance before 3.0.4 are vulnerable to a Path Traversal vulnerability. This vulnerability arises due to the lack of validation of the path passed to the package. As a result, a malicious user can exploit this vulnerability to read the content of any file with a known path.

Vulnerability Detail

The Path Traversal vulnerability in glance allows an attacker to access sensitive files on the system by manipulating the path parameter. By providing a crafted path containing directory traversal sequences (e.g., '../'), an attacker can bypass the intended restrictions and access files outside of the intended directory. This can lead to unauthorized disclosure of sensitive information, such as configuration files, credentials, or other sensitive data stored on the server. The impact of this vulnerability can be severe, depending on the files that can be accessed.

npm install glance@3.0.4

Workaround

If updating to the latest version is not immediately feasible, a temporary workaround can be implemented by manually validating the path parameter before passing it to the glance package. This can be done by checking if the requested file path is within the expected directory structure and denying access if it contains any directory traversal sequences. Here is an example of how to implement this workaround in Node.js:

const path = require('path');

function validatePath(filePath) {
  const basePath = '/path/to/expected/directory';
  const resolvedPath = path.resolve(basePath, filePath);

  if (!resolvedPath.startsWith(basePath)) {
    throw new Error('Invalid file path');
  }

  return resolvedPath;
}

// Usage:
const filePath = validatePath(req.query.file);
// Pass the validated filePath to the glance package

Conclusion

The Path Traversal vulnerability in the glance package can allow an attacker to read sensitive files on the system. It is crucial to update to version 3.0.4 or later to mitigate this vulnerability. If immediate updating is not possible, implementing the provided workaround can help protect against potential attacks. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for glance →

FAQ