GHSA-v7cp-5326-54fh Path Traversal in bruteser
Attackers can read arbitrary server files outside the served directory due to unsanitized URL handling in the bruteser library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-v7cp-5326-54fh?
GHSA-v7cp-5326-54fh is a path traversal vulnerability in bruteser, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of bruteser prior to 0.1.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.
Recommendation
Upgrade to version 0.1.0 or later.
Which versions are affected by GHSA-v7cp-5326-54fh?
2 open source packages ship an affected version, including bruteser.
| Package | Affected | Fixed in |
|---|---|---|
bruteser npm | All versions | 0.1.0 |
bruteser npm | All versions | 0.1.0 |
How do I fix GHSA-v7cp-5326-54fh?
Upgrade bruteser to 0.1.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-v7cp-5326-54fh being exploited?
There is no known exploitation of GHSA-v7cp-5326-54fh in the wild and no public exploit code.