Critical, CVSS 9.1npmAmendedPublished
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
CVE-2024-48914 · GHSA-r9mq-3c9r-fmjq
- Affected
- npm @vendure/asset-server-plugin < 2.3.3; >= 3.0.0, < 3.0.5
- Fixed in
- 2.3.33.0.5· Vendor fix available
- Issue
- Path traversal This vulnerability allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. From Rajesh Sharma who discovered the vulnerability: POC: curl --path-as-is http://localhost:3000/assets/../package.json gives you the content of package.json present in the local directory. The vulnerability stems from usage of decodedReqPath directly in path.join without performing any path normalization i.e path.normalize in node.js https://github.com/vendure-ecommerce/vendure/blob/801980e8f599c28c5059657a9d85dd03e3827992/packages/asset-server-plugin/src/plugin.ts#L352-L358 If the vendure service is behind some server like nginx, apache, etc. Path normalization is performed on the root server level but still the actual client's request path will be sent to vendure service but not the…
Recommended action: Upgrade to 3.0.5 or 2.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.