GHSA-cr67-78jr-j94p

Source

https://github.com/advisories/GHSA-cr67-78jr-j94p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-cr67-78jr-j94p/GHSA-cr67-78jr-j94p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cr67-78jr-j94p

Published

2020-09-03T18:14:47Z

Modified

2020-08-31T18:46:25Z

Summary

Local File Inclusion in domokeeper

Details

All versions of domokeeper are vulnerable to Local File Inclusion. The /plugin/ route passes a GET parameter unsanitized to a require() call. It then returns the output of require() in the server response. This may allow attackers to load unintended code in the application. It also allows attackers to exfiltrate information in .json files.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:46:25Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

https://www.npmjs.com/advisories/1075

Affected packages

npm / domokeeper

Package

Name: domokeeper; View open source insights on deps.dev
Purl: pkg:npm/domokeeper

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-cr67-78jr-j94p/GHSA-cr67-78jr-j94p.json"