QID 980755

QID 980755: Nodejs (npm) Security Update for socket.io-file (GHSA-9h4g-27m8-qjrg)

All versions of `socket.io-file` are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The `socket.io-file::createFile` message contains a `name` option that is passed directly to `path.join()`. It is possible to upload files to arbitrary folders on the server by sending relative paths on the `name` value, such as `../../test.js`. The `uploadDir` and `rename` options can be used to define the file upload path.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to GHSA-9h4g-27m8-qjrg for updates pertaining to this vulnerability.

Vendor References

GHSA-9h4g-27m8-qjrg - github.com/advisories/GHSA-9h4g-27m8-qjrg

CVEs related to QID 980755

CVE-2020-15779 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-9h4g-27m8-qjrg	socket.io-file		github.com/advisories/GHSA-9h4g-27m8-qjrg

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].