Local File Inclusion Vulnerability in domokeeper
Summary
GHSA-cr67-78jr-j94p: Local File Inclusion in domokeeper. Affects domokeeper versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
domokeeper is an npm package that provides functionality for managing and monitoring IoT devices. It allows users to control and monitor their smart home devices through a centralized interface. However, all versions of domokeeper are vulnerable to a Local File Inclusion (LFI) vulnerability.
Vulnerability Detail
The LFI vulnerability in domokeeper arises from the unsanitized passing of a GET parameter to a require() call in the /plugin/ route. This allows attackers to manipulate the GET parameter and load unintended code in the application. Additionally, it enables attackers to exfiltrate information from .json files. The impact of this vulnerability can be severe, as it compromises the integrity and confidentiality of the application's data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no official fix, a possible workaround is to implement input validation and sanitization for the GET parameter passed to the require() call in the /plugin/ route. By ensuring that only trusted and authorized values are accepted, the risk of LFI can be mitigated. Here is an example of how input validation can be implemented in Node.js:
const fs = require('fs');
const path = require('path');
function requirePlugin(pluginName) {
const allowedPlugins = ['plugin1', 'plugin2', 'plugin3'];
if (allowedPlugins.includes(pluginName)) {
const pluginPath = path.join(__dirname, 'plugins', pluginName);
return require(pluginPath);
}
throw new Error('Invalid plugin name');
}
Conclusion
The Local File Inclusion vulnerability in domokeeper poses a significant risk to the integrity and confidentiality of the application's data. Currently, there is no fix available, and it is recommended to consider using an alternative package. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for domokeeper →
FAQ
domokeeper is an npm package used for managing and monitoring IoT devices in a smart home environment. It provides a centralized interface for controlling and monitoring various smart home devices.
Local File Inclusion (LFI) is a vulnerability that allows an attacker to include local files on a server through unsanitized user input. In the case of domokeeper, the LFI vulnerability allows an attacker to manipulate a GET parameter and load unintended code or exfiltrate information from .json files.
The Local File Inclusion vulnerability in domokeeper can lead to the execution of unintended code, compromising the integrity and confidentiality of the application's data. It also allows attackers to exfiltrate sensitive information from .json files, potentially exposing user data or system configurations.
Currently, there is no fix available for this vulnerability in domokeeper. It is recommended to consider using an alternative package until a fix is provided by the maintainers.
To mitigate the risk of the Local File Inclusion vulnerability in domokeeper, it is recommended to implement input validation and sanitization for the GET parameter passed to the require() call in the /plugin/ route. By ensuring that only trusted and authorized values are accepted, the risk of LFI can be reduced.
