@saltcorn/server arbitrary file and directory listing when accessing build mobile app results

🗓️ 03 Oct 2024 19:46:42Reported by GitHub Advisory DatabaseType

A user with admin permission can read arbitrary file and directory names on the filesystem by calling the `admin/build-mobile-app/result?build_dir_name=` endpoint. The `build_dir_name` parameter is not properly validated and it's then used to construct the `buildDir` that is read. The file/directory names under the `buildDir` will be returned

Vulners

Node

saltcorn serverRange≤1.0.0-beta.13npm

Source	Link
github	www.github.com/saltcorn/saltcorn/security/advisories/GHSA-cfqx-f43m-vfh7
github	www.github.com/saltcorn/saltcorn/commit/81adaf78430a9b59804894574d67d2a0c7bb3dc5
github	www.github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js
github	www.github.com/advisories/GHSA-cfqx-f43m-vfh7

04 Oct 2024 16:51Current

7High risk

Vulners AI Score7

CWE-548