CVE-2023-47440: Directory Traversal in Gladys Assistant
Summary
CVE-2023-47440: Directory Traversal in Gladys Assistant. Affects gladys versions < 4.27.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gladys Assistant is an npm package that provides an open-source home automation system. It allows users to control various smart devices and manage their home automation setup. The package is widely used and offers a range of features for home automation enthusiasts. However, versions up to and including v4.27.0 are vulnerable to a Directory Traversal attack.
Vulnerability Detail
The vulnerability, identified as CVE-2023-47440, is a result of an incomplete patch for a previous vulnerability (CVE-2023-43256). This allows authenticated attackers to exploit a directory traversal flaw and extract sensitive files from the host machine. By manipulating file paths, an attacker can bypass security measures and access files outside of the intended directory. This could lead to unauthorized disclosure of sensitive information and potential compromise of the host system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is crucial to update the package to the latest version as soon as possible to eliminate the risk of exploitation.
Conclusion
In conclusion, Gladys Assistant v4.27.0 and prior versions are vulnerable to a Directory Traversal attack. It is crucial to update the package to a version beyond v4.27.0 to mitigate the risk. The maintainers have released a patch to address the vulnerability, and it is recommended to follow best practices for securing the host machine. For further support, you can contact DevNack.com.
See every vulnerability recorded for gladys →
FAQ
Gladys Assistant is an open-source home automation system that allows users to control smart devices and manage home automation setups.
The vulnerability allows authenticated attackers to extract sensitive files from the host machine, potentially leading to unauthorized disclosure of sensitive information.
To fix this vulnerability, update Gladys Assistant to a version beyond v4.27.0, as the maintainers have released a patch that addresses the issue.
There is no specific workaround mentioned for this vulnerability. Updating to the latest version is the recommended solution.
For further support on vulnerability remediation, you can reach out to info@devnack.com.
