Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Mockoon's admin API (commons-server/src/libs/server/admin-api.ts) is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime (commons-server, CLI, serverless), serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods allowed including PUT/POST/PATCH/DELETE/PURGE and Content-Type in Access-Control-Allow-Headers, and has zero authentication of any kind (no token, no shared secret, no MOCKOONADMINTOKEN env var — searched the repo, returns zero hits). Any unauthenticated caller who can reach the mock server's port (default 0.0.0.0:3000) can: - Read every MOCKOON env var used by the operator as secret material in templates (getEnvVar helper). - Write arbitrary process env vars (no prefix check on the WRITE path) — poison operator's MOCKOONAPIKEY, MOCKOONJWTSECRET, …, or write process-level vars like AWSSECRETACCESSKEY that the surrounding runtime consumes. - Rewrite every mock route's body / status /…
Recommended action: Upgrade to 9.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A FILE response whose filePath embeds request data (e.g. "/srv/public/{{queryParam 'name'}}", the documented way to let the client pick a file) is confined by getSafeFilePath with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes. An unauthenticated client reads files from sibling paths outside the served directory. Details packages/commons-server/src/libs/server/server.ts, getSafeFilePath (line 2315). The static base is the text before the first {{, resolved to an absolute path; the parsed filePath is then bounded by a string-prefix check: With "/srv/public/{{queryParam 'name'}}", staticBaseDir = /srv/public. A request name=../publicbackup/.env resolves to /srv/publicbackup/.env, and "/srv/publicbackup/.env".startsWith("/srv/public") is true → served. Any sibling whose absolute path begins with the string /srv/public is reachable; the relative branch…
Recommended action: Upgrade to 9.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A mock API configuration for static file serving following the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server filesystem. The issue may be particularly relevant in cloud hosted server instances Details In sendFileWithCallback(code) and sendFile(code) the filePath variable is parsed using TemplateParser The path extracted from the request parameters used when composing the final file path is not sanitized and is vulnerable to path traversal exploits (e.g. ../../../../../etc/passwd) PoC Test setup The issue has been tested with mockoon-cli, using the Docker image mockoon/cli:latest config.json Payload to reproduce Browsing directly to http://localhost:3000/static/%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd is going to display the /etc/passwd file in the container filesystem
Recommended action: Upgrade to 9.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.