What is GHSA-f3vw-587g-r29g?

GHSA-f3vw-587g-r29g is a security advisory published by GitHub Security Advisories with Critical severity. Path Traversal in sapper

Why does GHSA-f3vw-587g-r29g have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-f3vw-587g-r29g?

GHSA-f3vw-587g-r29g affects 1 product, including: npm/sapper:\u003c 0.27.11.

GHSA-f3vw-587g-r29gCriticalDisclosed before NVD

Path Traversal in sapper

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

January 9, 2023

📋 Description

Versions of sapper prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded ../.

You may test a sapper application running in prod mode with curl -vvv http://localhost:3000/client/750af05c3a69ddc6073a/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd.

Recommendation

Upgrade to version 0.27.11 or later.

🎯 Affected products1

npm/sapper:< 0.27.11

🔗 References (2)

https://www.npmjs.com/advisories/1494
https://github.com/advisories/GHSA-f3vw-587g-r29g