Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through isrelativeurl(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL. Details Vulnerable function: packages/server/routes/utils.js:393-395 The function's intent is to allow only same-origin redirects, but the allow-list only checks for two literal substrings. It does not handle: - backslash characters, which WHATWG URL parsing (used by every modern browser) treats as forward slashes for the special schemes http, https, ftp, ws, wss. A URL parser fed /\evil.com/path with a base of http://victim/ resolves to…
Recommended action: Upgrade to 1.6.0-beta.5 (pre-release), 1.5.6 or 1.4.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A critical SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can lead to full database exfiltration, including admin password hashes and configuration secrets, and may also enable database modification or destruction depending on the backend. Details The issue affects the mobile-sync endpoints: - POST /sync/loadchanges - POST /sync/deletes According to the provided analysis, user-controlled values from the request body are interpolated directly into SQL template literals without parameterization, type enforcement, or sanitization. In particular, req.body.syncInfos[tableName].maxLoadedId is embedded into SQL in getSyncRows() and timestamp-derived values are similarly interpolated in getDelRows(). Relevant vulnerable code paths include: - packages/server/routes/sync.js — getSyncRows() - branch using where…
Recommended action: Upgrade to 1.6.0-beta.5 (pre-release), 1.5.6 or 1.4.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Two unauthenticated path traversal vulnerabilities exist in Saltcorn's mobile sync endpoints. The POST /sync/offlinechanges endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the server filesystem. The GET /sync/uploadfinished endpoint allows an unauthenticated attacker to list arbitrary directory contents and read specific JSON files. The safe path validation function File.normaliseinbase() exists in the codebase and is correctly used by the cleansyncdir endpoint in the same file (fix for GHSA-43f3-h63w-p6f6), but was not applied to these two endpoints. Details Finding 1: Arbitrary file write — POST /sync/offlinechanges (sync.js line 226) The newSyncTimestamp parameter from the request body is used directly in path.join() without sanitization: No authentication middleware is applied to this route. Since path.join() normalizes ../ sequences, setting newSyncTimestamp to…
Recommended action: Upgrade to 1.6.0-beta.4 (pre-release), 1.5.5 or 1.4.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
1. There is a reflected XSS vulnerability in the GET /admin/edit-codepage/:name route through the name parameter. This can be used to hijack the session of an admin if they click a specially crafted link. 2. Additionally, there is a Command Injection vulnerability in GET /admin/backup. The admin can inject a shell command in the backup password which is inserted in the command used to create the backup zip. Both vulnerabilities can be chained to craft a malicious link which will execute an arbitrary shell command on the server if it is clicked by a saltcorn admin with an active session. I believe iframes could also be used to exploit this silently when the admin visits an attacker-controlled web page (though I have not tested that). Details 1. The XSS vulnerability is here: https://github.com/saltcorn/saltcorn/blob/020893c0001678fd5ebd2c088ba68b395de1aabc/packages/server/routes/admin.js#L4886-L4887 Specifically, the name parameter is inserted into the pages breadcrumbs…
Recommended action: Upgrade to 1.5.0-beta.19 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability. Details - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/eventlog.js#L445 PoC The following PoC demonstrates how a non-admin user with permission to read/write on a table can inject malicious javascript code that will be executed in the event log admin panel if event logs are enabled. To demonstrate this issue, we need to prepare some components. The following steps should be executed with an admin user. 1. create a table with one column of type string set read/write permission to staff users (just as an example) - visit http://localhost:3000/table/new - create a table with Table name mytablexss and click Create - click Add field to add a field with Label called payload of type String and click Next - leave default values for Attributes and click Next - it should redirect to http://localhost:3000/table/<table-number - under Edit table…
Recommended action: Upgrade to 1.0.0-beta.16 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/cleansyncdir endpoint. The dirname POST parameter is not validated/sanitized and is used to construct the syncDir that is deleted by calling fs.rm. Details - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.15/packages/server/routes/sync.js#L337-L346 PoC The following PoC can be executed with a user with any role (admin, staff, user, public) - create a file in a folder different from where the server is started: - log with a user and retrieve valid connect.sid and csrf values - send the following curl request - check if the file previously created does not exist anymore: obtain connect.sid and csrf values A possible way to retrieve connect.sid and csrf values is to use the password reset functionality: - log in - open the browser developer console, go to the Network tab filter for settings request - visit http://localhost:3000/auth/settings - trigger the change password…
Recommended action: Upgrade to 1.0.0-beta.16 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The endpoint /site-structure/localizer/save-string/:lang/:defstring accepts two parameter values: lang and defstring. These values are used in an unsafe way to set the keys and value of the cfgStrings object. It allows to add/modify properties of the Object prototype that result in several logic issues, including: - RCE vulnerabilities by polluting the tempRootFolder property - SQL injection vulnerabilities by polluting the schema property when using PostgreSQL database. Details - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/infoarch.js#L236-L239 PoC Setup: - set SALTCORNNWORKERS=1 before starting the saltcorn server (to easily observe the behavior of the PoC) - make sure to use PostgresSQL backend - login with a user with admin permission RCE This PoC demonstrates how to escalate the Prototype Pollution vulnerability to change the behavior of certain command executed. - check that the file that will be created does not exists: -…
Recommended action: Upgrade to 1.0.0-beta.14 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A user with admin permission can read arbitrary file and directory names on the filesystem by calling the admin/build-mobile-app/result?builddirname= endpoint. The builddirname parameter is not properly validated and it's then used to construct the buildDir that is read. The file/directory names under the buildDir will be returned. Details - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L2884-L2893 PoC - log into the application as an admin user - visit the following url: http://localhost:3000/admin/build-mobile-app/result?builddirname=/../../../../../../../../ NOTE: it's possible to only see file and directory names but not to download their content. Impact Information disclosure Recommended Mitigation Resolve the buildDir and check if it starts with ${rootFolder.location}/mobileapp.
Recommended action: Upgrade to 1.0.0-beta.14 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to res.download API. Details - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682 Steps to reproduce (PoC) - create a file with .zip extension under /tmp folder: - log into the application as an admin user - visit the url http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip - download the zip file and then check if the zip was indeed downloaded: - Alternatively send the following request to retrieve the file just created. NOTE: To obtain a valid connect.sid cookie, just open the developer console while logged and retrieve the cookie value. Impact Arbitrary zip files download (information disclosure). Recommended…
Recommended action: Upgrade to 1.0.0-beta.14 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.