GHSA-886v-mm6p-4m66 High severity vulnerability that affects gun

Not scored Published 5 Jun 2019

An attacker can read arbitrary files from the server via path traversal in the static file server, potentially leaking sensitive environment variables and keys.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-886v-mm6p-4m66?

GHSA-886v-mm6p-4m66 is a path traversal vulnerability in gun, published on 5 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Urgent Upgrade

The static file server module included with GUN had a serious vulnerability:

Using curl --path-as-is allowed reads on any parent directory or files.

This did not work via the browser or via curl without as-is option.

Fixed

This has been fixed since version 0.2019.416 and higher.

Who Was Effected?

Most NodeJS users who use the default setup, such as:

npm start
node examples/http.js
Heroku 1-click-deploy
Docker
Now

If you have a custom NodeJS code then you are probably safe unless you have something like require('http').createServer(Gun.serve(__dirname)) in it.

If you have not upgraded, it is mandatory or else it is highly likely your environment variables and AWS (or other) keys could be leaked.

Credit

It was reported and fixed by JK0N, but I did not understand the --path-as-is condition.

Joonas Loppi from function61 rediscovered it and explained the urgency to me to fix it.

Which versions are affected by GHSA-886v-mm6p-4m66?

2 open source packages ship an affected version, including gun.

Package	Affected	Fixed in
`gun` npm	All versions	`0.2019.416`
`gun` npm	All versions	`0.2019.416`

How do I fix GHSA-886v-mm6p-4m66?

Upgrade gun to 0.2019.416 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is GHSA-886v-mm6p-4m66 being exploited?

There is no known exploitation of GHSA-886v-mm6p-4m66 in the wild and no public exploit code.