Log in Start free

Vulnerability · Published Oct 15, 2024 · Assigned by GitHub_M

CVE-2024-48914Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Critical 9.1

In plain English

A critical-severity path traversal in vendure from vendure-ecommerce. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 60.4% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)60.4%top 0.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC

Official description

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. In the same code path is an additional vector for crashing the server via a malformed URI. Patches are available in versions 3.0.5 and 2.3.3. Some workarounds are also available. One may use object storage rather than the local file system, e.g. MinIO or S3, or define middleware which detects and blocks requests with urls containing `/../`.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@vendure/asset-server-plugin2.3.3GHSA-r9mq-3c9r-fmjq
npm@vendure/asset-server-plugin3.0.5GHSA-r9mq-3c9r-fmjq

Affected products (as reported)

VendorProductVersions
vendure-ecommerce vendure < 2.3.3>= 3.0.0, < 3.0.5

Weakness: CWE-22, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References