Path Traversal Vulnerability in public npm package
Summary
GHSA-4vvp-x9h2-x2vf: Path Traversal in public. Affects public versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The public npm package is a module used for serving static files in Node.js applications. It allows developers to easily serve files from a specified directory. However, all versions of public are vulnerable to a Path Traversal vulnerability. This vulnerability enables an attacker to access files outside the webroot by exploiting symlink navigation in the URL.
Vulnerability Detail
The Path Traversal vulnerability in the public npm package allows an attacker to bypass the intended restrictions and access files outside the webroot. By manipulating the URL and utilizing symlink navigation, an attacker can traverse the file system and retrieve sensitive information or execute arbitrary code. This vulnerability poses a moderate risk and can lead to unauthorized access, data leakage, or remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no official fix for this vulnerability, a workaround is to implement additional security measures in your application. One possible approach is to manually validate and sanitize user input to prevent any malicious attempts at path traversal. Additionally, you can implement access controls and enforce strict file permissions to limit the potential impact of this vulnerability.
Conclusion
The public npm package is vulnerable to a Path Traversal vulnerability that allows attackers to access files outside the webroot. Currently, there is no fix available, and it is recommended to avoid using this package in production environments. Implementing additional security measures and monitoring for updates can help mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for public →
FAQ
The Path Traversal vulnerability in the public npm package allows an attacker to access files outside the webroot, potentially leading to unauthorized access, data leakage, or remote code execution.
Yes, all versions of the public npm package are vulnerable to this Path Traversal vulnerability.
Currently, there is no fix available for this vulnerability. It is recommended to avoid using the public package in production environments or consider using an alternative module.
To mitigate the risk, you can implement additional security measures such as input validation and access controls. It is also recommended to monitor the official repository for any updates or patches that may address this vulnerability.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4vvp-x9h2-x2vf/GHSA-4vvp-x9h2-x2vf.json
References
Related vulnerabilities
Recent vulnerabilities recorded for public.
