Path Traversal in ponse

Description

Versions of ponse prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

Update the ponse package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.2
• Patched version(s): 2.0.2

References

• GHSA-wfhx-6pcm-7m55
• hackerone.com
• www.npmjs.com
• CWE-22
• OWASP 2021-A1

Related Issues

• Path Traversal in sapper - Vulnerability
• Jan path traversal vulnerability - CVE-2024-37273
• obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr - Vulnerability
• Agnai File Disclosure Vulnerability: JSON via Path Traversal - CVE-2024-47170

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

ponse