CVE-2019-8903: Path Traversal in total.js
Summary
CVE-2019-8903: Path Traversal in total.js. Affects total.js versions < 3.2.3. Fixed in 3.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
total.js is an open-source web application framework written in JavaScript. It provides a modular and efficient platform for building web applications. However, versions of total.js prior to 3.2.3 are vulnerable to a Path Traversal attack. This vulnerability allows attackers to access server files outside the designated public folder by exploiting insufficient input sanitization in URLs. The files that can be accessed are limited to certain file types.
Vulnerability Detail
The Path Traversal vulnerability in total.js arises from a lack of proper input validation in URLs. By manipulating relative paths, attackers can bypass the intended restrictions and access sensitive files on the server. This can lead to unauthorized disclosure of sensitive information or even remote code execution. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
3.2.3
This is the first release that contains the fix.
npm install total.js@3.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Path Traversal vulnerability in total.js allows attackers to access server files outside the designated public folder. It is crucial to upgrade to the latest version of total.js to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for total.js →
FAQ
total.js is an open-source web application framework written in JavaScript. It provides a modular and efficient platform for building web applications.
Path Traversal is a vulnerability that allows attackers to access files and directories outside the intended scope of an application. In the case of total.js, it enables unauthorized access to server files outside the designated public folder.
The Path Traversal vulnerability in total.js can lead to unauthorized disclosure of sensitive information and even remote code execution. Attackers can access files containing sensitive data or exploit the server to execute arbitrary code.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for total.js.
