CVE-2022-24718: Path Traversal in @finastra/ssr-pages
Summary
CVE-2022-24718: Path Traversal in @finastra/ssr-pages. Affects @finastra/ssr-pages versions < 0.1.4. Fixed in 0.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @finastra/ssr-pages package is an npm package used for server-side rendering of pages. It provides a build function that takes in options, including an svg property. This package is vulnerable to a path traversal issue when untrusted input is provided to the svg property. This vulnerability can be exploited to access files outside of the intended directory.
Vulnerability Detail
The path traversal vulnerability in @finastra/ssr-pages occurs when untrusted input is passed to the svg property of the build function. An attacker can manipulate the input to traverse the file system and access sensitive files. This could lead to unauthorized disclosure of information or even remote code execution. The vulnerability has a CVSS score of 7.6, indicating a high severity.
How To Fix
Minimum fixed version
0.1.4
This is the first release that contains the fix.
npm install @finastra/ssr-pages@0.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the @finastra/ssr-pages package to mitigate the risk.
Conclusion
The @finastra/ssr-pages package is vulnerable to a path traversal issue that can be exploited to access sensitive files. To mitigate this vulnerability, it is crucial to upgrade to version 0.1.4 or later of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @finastra/ssr-pages →
FAQ
The vulnerability allows an attacker to access sensitive files outside of the intended directory, potentially leading to unauthorized disclosure of information or remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available in version 0.1.4 of the @finastra/ssr-pages package. It is recommended to upgrade to this version to mitigate the vulnerability.
There are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-w6cx-qg2q-rvq8/GHSA-w6cx-qg2q-rvq8.json
References
Related vulnerabilities
Recent vulnerabilities recorded for @finastra/ssr-pages.
