Unauthorized File Access in glance
Summary
GHSA-vw7g-jq9m-3q9v: Unauthorized File Access in glance. Affects glance versions < 3.0.7. Fixed in 3.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The glance package is an npm package used for file access and manipulation. It provides various functionalities for working with files and directories. However, versions prior to 3.0.7 are vulnerable to Unauthorized File Access. This vulnerability arises due to a flaw in the --nodot option provided by the package. While the option is intended to hide files and directories starting with a . (e.g., .git), it fails to hide files inside a folder that begins with ..
Vulnerability Detail
The vulnerability allows unauthorized users to access sensitive files that should be hidden. This can lead to potential security breaches and unauthorized access to confidential information. Attackers can exploit this vulnerability to gain access to files that should not be accessible to them, compromising the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
3.0.7
This is the first release that contains the fix.
npm install glance@3.0.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Unauthorized File Access in the glance package prior to version 3.0.7 can lead to unauthorized access to sensitive files. It is crucial to upgrade to the fixed version to ensure the security and integrity of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for glance →
FAQ
The vulnerability allows unauthorized users to access sensitive files, potentially leading to security breaches and unauthorized access to confidential information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the glance package.
There is no specific evidence of this vulnerability being exploited in the wild. However, it is always recommended to stay updated with the latest security patches and fixes to mitigate potential risks.
This vulnerability was discovered by the GitHub Security Lab and reported to the glance package maintainers.
References
Related vulnerabilities
Recent vulnerabilities recorded for glance.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
