Unauthorized File Access in node-git-server
Summary
GHSA-cv3v-7846-6pxm: Unauthorized File Access in node-git-server. Affects node-git-server versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-git-server is an npm package that provides a Git server implementation in Node.js. It allows users to host and manage Git repositories. However, versions prior to 0.6.1 are vulnerable to Unauthorized File Access. This vulnerability enables attackers to access any git repository by using absolute paths, potentially exposing private repositories.
Vulnerability Detail
The Unauthorized File Access vulnerability in node-git-server arises from a lack of proper access controls. By exploiting this vulnerability, an attacker can bypass authentication and gain unauthorized access to any git repository on the server. This can lead to the exposure of sensitive code, intellectual property, or other confidential information stored in private repositories.
How To Fix
Minimum fixed version
0.6.1
This is the first release that contains the fix.
npm install node-git-server@0.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Unauthorized File Access vulnerability in node-git-server can lead to unauthorized access to private git repositories. It is crucial to upgrade to version 0.6.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-git-server →
FAQ
node-git-server is an npm package that provides a Git server implementation in Node.js. It allows users to host and manage Git repositories.
The vulnerability allows attackers to access any git repository on the server, potentially exposing private repositories and sensitive information.
To fix this vulnerability, upgrade to version 0.6.1 or later of the node-git-server package.
No, upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to advisory]
