Summary
NPM’s package @evershop/evershop prior to 1.0.0-rc.8 is missing input validation in the function ‘mkdirSync’ in ‘createFolder.js’, leading to a Relative Path Traversal vulnerability that enables arbitrary folder creation. From the feature for adding an image to a Product’s “Description” field, attackers can create a new folder in unintended locations by navigating backward with “../”, potentially affecting system processes.
Product
This vulnerability affects NPM’s package @evershop/evershop in versions prior to 1.0.0-rc.8.
Impact
Although an attacker would be limited in the impact, this could be abused to bring some nefarious consequences. For instance, an attacker could create specific folders with common names in various locations on the filesystem that could eventually interfere with the regular functioning of some processes, even causing some to malfunction and break.
Steps to reproduce
- Install the
@evershop/evershoppackage dependency for any version prior to 1.0.0-rc.8 - Run the EverShop Web Application on localhost
- Navigate to
admin/products/new - In the Product’s “Description” field type
../../../hacked(use “../” as many times as needed to navigate backwards towards the desired folder) - Navigate to the chosen folder and list all the files and folders
Expected result:
New folder can be created in unintended locations
Remediation
A fix was released in commit 677651c, where input validation was implemented to protect against Path Traversal attacks. Users are recommended to upgrade to version 1.0.0-rc.8, which includes this fix.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Mário Teixeira.
