GHSA-f3vw-587g-r29g Path Traversal in sapper
Attackers can read sensitive server files via URL-encoded path traversal in Sapper applications, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-f3vw-587g-r29g?
GHSA-f3vw-587g-r29g is a path traversal vulnerability in sapper, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of sapper prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded ../.
You may test a sapper application running in prod mode with curl -vvv http://localhost:3000/client/750af05c3a69ddc6073a/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd.
Recommendation
Upgrade to version 0.27.11 or later.
Which versions are affected by GHSA-f3vw-587g-r29g?
2 open source packages ship an affected version, including sapper.
| Package | Affected | Fixed in |
|---|---|---|
sapper npm | All versions | 0.27.11 |
sapper npm | All versions | 0.27.11 |
How do I fix GHSA-f3vw-587g-r29g?
Upgrade sapper to 0.27.11 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-f3vw-587g-r29g being exploited?
There is no known exploitation of GHSA-f3vw-587g-r29g in the wild and no public exploit code.