Directory Traversal Vulnerability in node-simple-router
Summary
GHSA-f6gj-7592-5jxm: Directory Traversal. Affects node-simple-router versions < 0.10.1. Fixed in 0.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-simple-router is an npm package that provides a simple router for Node.js applications. It allows developers to define routes and handle HTTP requests easily. However, versions 0.10.0 and earlier of this package are vulnerable to a directory traversal issue.
Vulnerability Detail
The directory traversal vulnerability in node-simple-router allows an attacker to access files outside of the intended directory. By manipulating the path parameter in certain requests, an attacker can navigate to sensitive files on the server. This can lead to unauthorized access, disclosure of sensitive information, or even remote code execution.
How To Fix
Minimum fixed version
0.10.1
This is the first release that contains the fix.
npm install node-simple-router@0.10.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not possible immediately, a temporary workaround is to implement input validation and sanitization for the path parameter in the affected routes. Ensure that the path only contains allowed characters and restrict access to sensitive directories.
Conclusion
The directory traversal vulnerability in node-simple-router can have serious security implications. It is crucial to upgrade to the latest version or apply the provided workaround to mitigate the risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-simple-router →
FAQ
A directory traversal vulnerability allows an attacker to access files outside of the intended directory by manipulating input parameters.
The directory traversal vulnerability in node-simple-router can lead to unauthorized access, disclosure of sensitive information, or remote code execution.
Versions 0.10.0 and earlier of the node-simple-router package are affected by this vulnerability.
To fix this vulnerability, upgrade to version 0.10.1 or later of the node-simple-router package.
Yes, if upgrading immediately is not possible, you can implement input validation and sanitization for the affected routes.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-simple-router.
