Vulnerability in highcharts-export-server: Reading Internal HTTP Resources
Summary
GHSA-hfwx-c7q6-g54c: Vulnerability allowing for reading internal HTTP resources. Affects highcharts-export-server versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The highcharts-export-server package is a tool used for exporting Highcharts charts to various formats, such as PNG, PDF, and SVG. It provides a server that can be used to generate and export charts programmatically. The package is commonly used in web applications that utilize Highcharts for data visualization. However, a vulnerability has been discovered in versions prior to 2.1.0 that allows for reading and outputting files served by other services on the internal network where the export server is hosted.
Vulnerability Detail
The vulnerability in highcharts-export-server allows a malicious user to read and access files served by other services on the internal network. This can potentially lead to unauthorized access to internal web resources if the export server is exposed to the internet. The impact is limited to internal services that serve content via HTTP(S), and the attacker must have knowledge of internal hostnames/IP addresses. The vulnerability has been addressed in version 2.1.0 of the package.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
npm install highcharts-export-server@2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in highcharts-export-server that allows for reading internal HTTP resources has been addressed in version 2.1.0. It is crucial to upgrade to this version to mitigate the risk of unauthorized access to internal web resources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for highcharts-export-server →
FAQ
highcharts-export-server is a package used for exporting Highcharts charts to various formats.
The vulnerability allows for reading and accessing files served by other internal services, potentially leading to unauthorized access to internal web resources.
No, the vulnerability can be exploited if the export server is exposed to the internet, but it requires knowledge of internal hostnames/IP addresses.
Upgrading to version 2.1.0 of highcharts-export-server is the recommended solution. It is also advised to upgrade to the latest version of Highcharts for added input sanitation.
No, there are no known workarounds for this vulnerability. Upgrading to version 2.1.0 is required.
