Cross-site Request Forgery (CSRF) Affecting save-server package, versions <1.0.7
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SAVESERVER-597396
- published 5 Aug 2020
- disclosed 5 Aug 2020
- credit Unknown
Introduced: 5 Aug 2020
CVE-2020-15135 Open this link in a new tabHow to fix?
Upgrade save-server to version 1.0.7 or higher.
Overview
save-server is an A ShareX server built on Express, Bulma and SQLite with User support.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). The attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded.