Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02MmpyLTg0Z2Ytd21nNM4AA4eS

Default swagger-ui configuration exposes all files in the module

Impact

The default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module.

Patches

Update to v2.1.0

Workarounds

Use the baseDir option

References

HackerOne report
.

Permalink: https://github.com/advisories/GHSA-62jr-84gf-wmg4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02MmpyLTg0Z2Ytd21nNM4AA4eS
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 4 months ago
Updated: 3 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-62jr-84gf-wmg4, CVE-2024-22207
References:

• https://github.com/fastify/fastify-swagger-ui/security/advisories/GHSA-62jr-84gf-wmg4
• https://nvd.nist.gov/vuln/detail/CVE-2024-22207
• https://github.com/fastify/fastify-swagger-ui/commit/13d799a2c5f14d3dd5b15892e03bbcbae63ee6f7
• https://security.netapp.com/advisory/ntap-20240216-0002
• https://github.com/advisories/GHSA-62jr-84gf-wmg4

Repository: https://github.com/fastify/fastify-swagger-ui
Blast Radius: 15.2

Affected Packages