Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg4NnYtbW02cC00bTY2

High severity vulnerability that affects gun

Urgent Upgrade

The static file server module included with GUN had a serious vulnerability:

• Using curl --path-as-is allowed reads on any parent directory or files.

This did not work via the browser or via curl without as-is option.

Fixed

This has been fixed since version 0.2019.416 and higher.

Who Was Effected?

Most NodeJS users who use the default setup, such as:

• npm start
• node examples/http.js
• Heroku 1-click-deploy
• Docker
• Now

If you have a custom NodeJS code then you are probably safe unless you have something like require('http').createServer(Gun.serve(__dirname)) in it.

If you have not upgraded, it is mandatory or else it is highly likely your environment variables and AWS (or other) keys could be leaked.

Credit

It was reported and fixed by JK0N, but I did not understand the --path-as-is condition.

Joonas Loppi from function61 rediscovered it and explained the urgency to me to fix it.

Permalink: https://github.com/advisories/GHSA-886v-mm6p-4m66
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg4NnYtbW02cC00bTY2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago

Identifiers: GHSA-886v-mm6p-4m66
References:

• https://github.com/amark/gun/security/advisories/GHSA-886v-mm6p-4m66
• https://github.com/advisories/GHSA-886v-mm6p-4m66

Repository: https://github.com/amark/gun
Blast Radius: 0.0

Affected Packages