Path Traversal Vulnerability in algo-httpserv
Summary
GHSA-cgjv-rghq-qhgp: Path Traversal in algo-httpserv. Affects algo-httpserv versions < 1.1.2. Fixed in 1.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
algo-httpserv is an npm package that provides a server for handling HTTP requests. It is used to create web applications and APIs. The package is vulnerable to a Path Traversal attack, which allows attackers to access server files by exploiting insufficient input sanitization. This vulnerability affects versions prior to 1.1.2.
Vulnerability Detail
The Path Traversal vulnerability in algo-httpserv arises from a lack of proper input sanitization. Attackers can exploit this by using relative paths to access sensitive server files. This can lead to unauthorized access, disclosure of sensitive information, and potential compromise of the server. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Minimum fixed version
1.1.2
This is the first release that contains the fix.
npm install algo-httpserv@1.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Path Traversal vulnerability in algo-httpserv can be mitigated by upgrading to version 1.1.2 or later. This will ensure that the necessary input sanitization is in place to prevent attackers from accessing server files. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for algo-httpserv →
FAQ
The vulnerability allows attackers to access server files, potentially leading to unauthorized access and disclosure of sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the algo-httpserv package.
No, only versions prior to 1.1.2 are affected by this vulnerability. Upgrading to version 1.1.2 or later will fix the issue.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-cgjv-rghq-qhgp/GHSA-cgjv-rghq-qhgp.json
