Unauthorized File Access in atompm

Description

Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system.

Recommendation

Update the atompm package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.8.2
• Patched version(s): 0.8.2

References

• GHSA-v86x-f47q-f7f4
• www.npmjs.com
• CWE-200
• OWASP 2021-A1

Related Issues

• Unauthorized File Access in harp - harp - CVE-2019-5438
• Unauthorized File Access in harp - CVE-2019-5437
• Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath - Vulnerability
• Gatsby develop server has Local File Inclusion vulnerability - CVE-2023-34238

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

atompm