High severity vulnerability that affects gun

Description

The static file server module included with GUN had a serious vulnerability:

• Using curl --path-as-is allowed reads on any parent directory or files.

This did not work via the browser or via curl without as-is option.

Fixed

This has been fixed since version 0.2019.416 and higher.

Who Was Effected?

Recommendation

Update the gun package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2019.416
• Patched version(s): 0.2019.416

References

• GHSA-886v-mm6p-4m66
• CWE-22
• OWASP 2021-A1

Related Issues

• Moderate severity vulnerability that affects validator (GHSA-rh6c-q938-3r9q) - CVE-2013-7452
• Moderate severity vulnerability that affects validator (GHSA-552w-rqg8-gxxm) - CVE-2013-7453
• Moderate severity vulnerability that affects marked - CVE-2017-17461
• Moderate severity vulnerability that affects validator - CVE-2013-7451

Tags:

npm

gun