Homepage
About Snyk

save-server@1.0.4 vulnerabilities

A powerful ShareX image and URL server, with support for multiple users.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the save-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Cross-site Request Forgery (CSRF)

save-server is an A ShareX server built on Express, Bulma and SQLite with User support.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). The attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade save-server to version 1.0.7 or higher.

<1.0.7
Go back to all versions of this package