Exposure of Information Through Directory Listing Affecting @saltcorn/server package, versions <1.0.0-beta.14
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SALTCORNSERVER-8163072
- published 6 Oct 2024
- disclosed 3 Oct 2024
- credit Alessio Della Libera
How to fix?
Upgrade @saltcorn/server to version 1.0.0-beta.14 or higher.
Overview
@saltcorn/server is a Server app for Saltcorn, open-source no-code platform
Affected versions of this package are vulnerable to Exposure of Information Through Directory Listing due to missing validations of the build_dir_name parameter. This allows an attacker with admin permission to view files and directories on the filesystem.
Note: It is possible to only see file and directory names but not to download their content.
##Workaround
Users who are not able to upgrade to the fixed version are advised to resolve the buildDir and check if it starts with ${rootFolder.location}/mobile_app.
PoC
- Log into the application as an admin user
- Visit the following url:
http://localhost:3000/admin/build-mobile-app/result?build_dir_name=/../../../../../../../../