CVE-2022-24718 Path Traversal in ssr-pages
An attacker can exploit a path traversal vulnerability in the ssr-pages library to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24718?
CVE-2022-24718 is a high-severity path traversal vulnerability in Finastra ssr-pages, published on 1 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.4.
Weakness: CWE-22
Which versions are affected by CVE-2022-24718?
2 open source packages ship an affected version, including @finastra/ssr-pages. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@finastra/ssr-pages npm | All versions | 0.1.4 |
@finastra/ssr-pages npm | All versions | 0.1.4 |
Products include Finastra Ssr-Pages.
How do I fix CVE-2022-24718?
Upgrade @finastra/ssr-pages to 0.1.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-24718 being exploited?
There is no known exploitation of CVE-2022-24718 in the wild and no public exploit code.
Other vulnerabilities in Finastra ssr-pages
Sources
Also known as GHSA-w6cx-qg2q-rvq8.