Arbitrary Code Execution Affecting express-cart package, versions <1.1.7
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:express-cart:20180606
- published 6 Jun 2018
- disclosed 6 Jun 2018
- credit Patrick (patrickrbc)
How to fix?
Upgrade express-cart to version 1.1.7 or higher.
Overview
express-cart is a fully functional shopping cart built in Node.js (Express, MongoDB) with Stripe, PayPal and Authorize.net payments.
Affected versions of this package are vulnerable to Arbitrary Code Execution. It allows a privileged users to upload files to the server, and choose which path it'll be saved in. The path does not do through validation, nor is the file type or size validated. This may allow an attacker to upload malicious files that may execute code on the server, send data back to the attacker or cause a denial of service.