Vulnerabilities

 10 via 12 paths

Dependencies

 110

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 4
  • 6
Status
  • 10
  • 0
  • 0

high severity
new

Directory Traversal

  • Vulnerable module: decompress
  • Introduced through: decompress@4.2.1

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › decompress@4.2.1

Overview

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Directory Traversal via improper validation in the safeMakeDir function and extraction path validation process. An attacker can write arbitrary files outside the intended extraction directory by crafting archive entries with paths that exploit the flawed containment check and unvalidated symlink creation.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for decompress.

References

Directory Traversal vulnerability report

high severity
new

Directory Traversal

  • Vulnerable module: decompress
  • Introduced through: decompress@4.2.1

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › decompress@4.2.1

Overview

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Directory Traversal and link following during archive extraction, where symlink and hardlink entries are created without checking their targets and the directory containment check relies on a string prefix comparison. An attacker can read or write files outside the target directory, and create setuid, setgid, or sticky-bit files when extraction runs as root, by supplying an archive containing out-of-target link entries, a path that shares a prefix with the output directory such as /srv/out-old against /srv/out, or entries whose modes retain special bits that mode & ~umask fails to strip. Exploitation requires extracting an untrusted or attacker-influenced archive in tar, tar.gz, tar.bz2, or zip format, and the privileged-file outcome requires extraction to run as root.

Workaround

The privileged-file outcome can be avoided by running extraction as a non-root user, which prevents the permission flaw from creating setuid, setgid, or sticky-bit files, though it does not address the path traversal or link-following flaws.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for decompress.

References

Directory Traversal vulnerability report

high severity
new

Heap-based Buffer Overflow

  • Vulnerable module: sharp
  • Introduced through: sharp@0.33.4

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › sharp@0.33.4
    Remediation: Upgrade to sharp@0.35.0.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the bundled libvips TIFF loader (VipsForeignLoadTiff), which can miscount the channels of a tile encoded as JPEG or JPEG2000 within a TIFF image. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a TIFF whose JPEG or JPEG2000 tiles cause the channel count to be misdetermined and the buffer undersized. Exploitation requires the application to decode an untrusted TIFF with JPEG or JPEG2000 tiles through sharp.

Workaround

This vulnerability can be avoided by blocking the TIFF loader through sharp's block() for the VipsForeignLoadTiff operation, or by setting the VIPS_BLOCK_UNTRUSTED environment variable, so untrusted TIFF images are not decoded.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity
new

Integer Overflow

  • Vulnerable module: sharp
  • Introduced through: sharp@0.33.4

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › sharp@0.33.4
    Remediation: Upgrade to sharp@0.35.0.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader (VipsForeignLoadVips), which can miscompute image dimensions. An attacker can corrupt heap memory and crash the process, with a possibility of code execution, by supplying a VIPS (.vips) image whose dimensions overflow the size calculation. Exploitation requires the application to decode an untrusted VIPS image through sharp.

Workaround

This vulnerability can be avoided by blocking the VIPS loader through sharp's block() for the VipsForeignLoadVips operation, or by setting the VIPS_BLOCK_UNTRUSTED environment variable, so untrusted VIPS images are not decoded.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

Integer Overflow vulnerability report

medium severity
new

Symlink Attack

  • Vulnerable module: decompress
  • Introduced through: decompress@4.2.1

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › decompress@4.2.1

Overview

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Symlink Attack in the symlink handling process. An attacker can create arbitrary symbolic links outside the intended extraction directory by crafting an archive with malicious symlink entries, potentially exposing sensitive files when the application accesses the extracted contents.

Remediation

There is no fixed version for decompress.

References

Symlink Attack vulnerability report

medium severity
new

Symlink Attack

  • Vulnerable module: decompress
  • Introduced through: decompress@4.2.1

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › decompress@4.2.1

Overview

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Symlink Attack via the fs.link process. An attacker can gain unauthorized access to sensitive files or corrupt file contents by crafting an archive containing a hardlink entry with a linkname field set to an absolute path on the same filesystem. This allows the creation of a hardlink in the extraction directory that points to any file on the same filesystem, enabling both reading and overwriting of the original file's content. This is only exploitable if the attacker is able to supply a crafted archive and the extraction occurs on the same filesystem as the target file.

Remediation

There is no fixed version for decompress.

References

Symlink Attack vulnerability report

medium severity
new

Integer Overflow

  • Vulnerable module: sharp
  • Introduced through: sharp@0.33.4

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › sharp@0.33.4
    Remediation: Upgrade to sharp@0.35.0.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader (VipsForeignLoadNsgif), which can miscompute image dimensions on 32-bit systems. An attacker can crash the process by supplying a GIF whose dimensions overflow the size calculation. Exploitation affects only 32-bit systems and requires the application to decode an untrusted GIF through sharp.

Workaround

This vulnerability can be avoided by blocking the GIF loader through sharp's block() for the VipsForeignLoadNsgif operation, or by setting the VIPS_BLOCK_UNTRUSTED environment variable, so untrusted GIF images are not decoded.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

Integer Overflow vulnerability report

medium severity
new

Out-of-bounds Read

  • Vulnerable module: sharp
  • Introduced through: sharp@0.33.4

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › sharp@0.33.4
    Remediation: Upgrade to sharp@0.35.0.

Overview

sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images

Affected versions of this package are vulnerable to Out-of-bounds Read and null pointer dereference in the bundled libvips EXIF decoder, which does not validate the range of EXIF tag groups before passing them to libexif. An attacker can crash the process by supplying an image whose embedded EXIF metadata carries an out-of-range tag group. Exploitation requires the application to process an untrusted image whose EXIF metadata sharp reads.

Remediation

Upgrade sharp to version 0.35.0 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Arbitrary File Write via Archive Extraction (Zip Slip)

  • Vulnerable module: decompress-tar
  • Introduced through: decompress@4.2.1

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › decompress@4.2.1 › decompress-tar@4.1.1
  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › decompress@4.2.1 › decompress-tarbz2@4.1.1 › decompress-tar@4.1.1
  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › decompress@4.2.1 › decompress-targz@4.1.1 › decompress-tar@4.1.1

Overview

decompress-tar is a tar plugin for decompress.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). It is possible to bypass the security measures provided by decompress and conduct ZIP path traversal through symlinks.

PoC

const decompress = require('decompress');

decompress('slip.tar.gz', 'dist').then(files => {
    console.log('done!');
});

Details

It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:


+2018-04-15 22:04:29 ..... 19 19 good.txt

+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for decompress-tar.

References

Arbitrary File Write via Archive Extraction (Zip Slip) vulnerability report

medium severity

Arbitrary File Write via Archive Extraction (Zip Slip)

  • Vulnerable module: decompress
  • Introduced through: decompress@4.2.1

Detailed paths

  • Introduced through: iobroker.cameras@ioBroker/ioBroker.cameras › decompress@4.2.1

Overview

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive.

Note:

This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for CVE-2020-12265.

Details

It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:


+2018-04-15 22:04:29 ..... 19 19 good.txt

+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for decompress.

References

Arbitrary File Write via Archive Extraction (Zip Slip) vulnerability report