Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-vvmv-wrvp-9gjr
No affected components available
Summary
When trying to add a BLOCK_LIST feature when the maintainer noticed they didn't sanitize the ImageId in the code, which leads to path traversal vulnerability. Now, this is different from a traditional path traversal issue, because as of NOW you can store the image in any place arbitrarily, and given enough time they might be able to come up with a working exploit BUT for the time being they am reporting this.
Details
@jmondi/url-to-png does not sanitizing the ImageID as in not removing special chars from the params (extract_query_params.ts#l75)
const imageId = dateString + "." + slugify(validData.url) +configToString(params);
This when fed to other parts of the code such as (filesystem.ts#L34)
return path.join(this.storagePath, imageId) + ".png";
Would result in path traversal issue.
PoC
# Configuration for filesystem storage provider (optional)
STORAGE_PROVIDER=filesystem
IMAGE_STORAGE_PATH=poc
Set this in your .env file and use this as your payload.
http://localhost:3089/?url=http://example.com&width=400&isDarkMode=../../../../../../../../../../../../tmp/hack
This will create a .png file in the /tmp section of the system.
Loom POC: https://www.loom.com/share/bd7b306cdae7445c97e68f0626e743a6
This is valid for pretty much all the arguments (except for numeric values)
A simple fix would be to use the slugify for the params as well like so (#L75)
- const imageId = dateString + "." + slugify(validData.url) + configToString(params);
+ const imageId = dateString + "." + slugify(validData.url) + slugify(configToString(params));
Impact
This would be path traversal vulnerability which allows arbitrary write as of now.
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the integrity of the data.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard