GHSA-v86x-f47q-f7f4 Unauthorized File Access in atompm
Attackers can download arbitrary files from the system due to unsanitized relative paths in atompm file downloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-v86x-f47q-f7f4?
GHSA-v86x-f47q-f7f4 is a path traversal vulnerability in atompm, published on 11 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system.
Recommendation
Upgrade to version 0.8.2 or later.
Which versions are affected by GHSA-v86x-f47q-f7f4?
2 open source packages ship an affected version, including atompm.
| Package | Affected | Fixed in |
|---|---|---|
atompm npm | All versions | 0.8.2 |
atompm npm | All versions | 0.8.2 |
How do I fix GHSA-v86x-f47q-f7f4?
Upgrade atompm to 0.8.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-v86x-f47q-f7f4 being exploited?
There is no known exploitation of GHSA-v86x-f47q-f7f4 in the wild and no public exploit code.