CVE-2019-5457: Cross-Site Scripting in min-http-server
Summary
CVE-2019-5457: Cross-Site Scripting in min-http-server. Affects min-http-server versions < 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The min-http-server package is an npm package used for creating a minimalistic HTTP server. It provides a simple way to serve static files and handle basic HTTP requests. The package is vulnerable to Cross-Site Scripting (XSS) attacks, where malicious code can be executed in a victim's browser through files with specially crafted names.
Vulnerability Detail
The vulnerability in min-http-server arises from the package's failure to properly sanitize filenames. This allows attackers to inject arbitrary JavaScript code into the victim's browser when files with malicious names are accessed. The impact of this vulnerability can range from unauthorized data access to complete control over the victim's browser session. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, a possible workaround is to manually sanitize filenames before serving them using the min-http-server package. This can be done by implementing a custom file name validation and sanitization function that ensures only safe characters are allowed in filenames.
Conclusion
The min-http-server package is vulnerable to Cross-Site Scripting (XSS) attacks due to its failure to properly sanitize filenames. This can lead to the execution of arbitrary JavaScript code in the victim's browser. Currently, there is no fix available for this vulnerability, and it is recommended to use an alternative package until a fix is provided. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for min-http-server →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in the victim's browser, potentially leading to unauthorized data access or complete control over the victim's browser session.
No, there is currently no fix available for this vulnerability in the min-http-server package.
Yes, all versions of min-http-server up to and including version 1.0.6 are affected by this vulnerability.
Yes, it is recommended to consider using an alternative package that does not suffer from this vulnerability until a fix is made available for min-http-server.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-j657-59rv-qwm6/GHSA-j657-59rv-qwm6.json
