GHSA-wm77-q74p-5763 Path Traversal in superstatic
Attackers can read arbitrary files via path traversal in superstatic, particularly on Windows or specific Node.js versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wm77-q74p-5763?
GHSA-wm77-q74p-5763 is a path traversal vulnerability in superstatic, published on 27 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected of superstatic are vulnerable to path traversal when used on Windows.
Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \\ to / in paths on all platforms (a known example being Node.js v9.9.0).
Recommendation
Update to version 5.0.2 or later.
Which versions are affected by GHSA-wm77-q74p-5763?
2 open source packages ship an affected version, including superstatic.
| Package | Affected | Fixed in |
|---|---|---|
superstatic npm | All versions | 5.0.2 |
superstatic npm | All versions | 5.0.2 |
How do I fix GHSA-wm77-q74p-5763?
Upgrade superstatic to 5.0.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-wm77-q74p-5763 being exploited?
There is no known exploitation of GHSA-wm77-q74p-5763 in the wild and no public exploit code.