Vulnerability · Published May 14, 2024 · Assigned by GitHub_M

CVE-2024-34712Oceanic allows unsanitized user input to lead to path traversal in URLs

Medium 6.5

In plain English

A medium-severity path traversal in Oceanic from OceanicJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban. Version 1.10.4 fixes this issue. Some workarounds are available. One may sanitize user input, ensuring strings are valid for the purpose they are being used for. One may also encode input with `encodeURIComponent` before providing it to the library.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	oceanic.js	1.10.4	GHSA-5h5v-hw44-f6gg

Affected products (as reported)

Vendor	Product	Versions
OceanicJS	Oceanic	< 1.10.4

Weakness: CWE-23, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/OceanicJS/Oceanic/security/advisories/GHSA-5h5v-hw44-f6gg x_refsource_CONFIRM
https://github.com/OceanicJS/Oceanic/commit/8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe x_refsource_MISC