GHSA-rv49-54qp-fw42 Path Traversal in servey
Attackers can access server files via relative paths due to insufficient input sanitization in the servey library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-rv49-54qp-fw42?
GHSA-rv49-54qp-fw42 is a path traversal vulnerability in servey, published on 6 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of servey prior to 3.x are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths.
Recommendation
Upgrade to the latest version
Which versions are affected by GHSA-rv49-54qp-fw42?
2 open source packages ship an affected version, including servey.
| Package | Affected | Fixed in |
|---|---|---|
servey npm | All versions | 3.1.0 |
servey npm | All versions | 3.1.0 |
How do I fix GHSA-rv49-54qp-fw42?
Upgrade servey to 3.1.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-rv49-54qp-fw42 being exploited?
There is no known exploitation of GHSA-rv49-54qp-fw42 in the wild and no public exploit code.