CVE-2024-48914

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. In the same code path is an additional vector for crashing the server via a malformed URI. Patches are available in versions 3.0.5 and 2.3.3. Some workarounds are also available. One may use object storage rather than the local file system, e.g. MinIO or S3, or define middleware which detects and blocks requests with urls containing `/../`.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/vendure-ecommerce/vendure/blob/801980e8f599c28c5059657a9d85dd03e3827992/packages/asset-server-plugin/src/plugin.ts#L352-L358
https://github.com/vendure-ecommerce/vendure/commit/e2ee0c43159b3d13b51b78654481094fdd4850c5
https://github.com/vendure-ecommerce/vendure/commit/e4b58af6822d38a9c92a1d8573e19288b8edaa1c
https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-r9mq-3c9r-fmjq

Configurations

No configuration.

History

No history.

Information

Published : 2024-10-15 16:15

Updated : 2024-10-16 16:38

NVD link : CVE-2024-48914

Mitre link : CVE-2024-48914

CVE.ORG link : CVE-2024-48914

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-48914", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-10-15T16:15:06.270", "references": [{"url": "https://github.com/vendure-ecommerce/vendure/blob/801980e8f599c28c5059657a9d85dd03e3827992/packages/asset-server-plugin/src/plugin.ts#L352-L358", "source": "security-advisories@github.com"}, {"url": "https://github.com/vendure-ecommerce/vendure/commit/e2ee0c43159b3d13b51b78654481094fdd4850c5", "source": "security-advisories@github.com"}, {"url": "https://github.com/vendure-ecommerce/vendure/commit/e4b58af6822d38a9c92a1d8573e19288b8edaa1c", "source": "security-advisories@github.com"}, {"url": "https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-r9mq-3c9r-fmjq", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the server. In the same code path is an additional vector for crashing the server via a malformed URI. Patches are available in versions 3.0.5 and 2.3.3. Some workarounds are also available. One may use object storage rather than the local file system, e.g. MinIO or S3, or define middleware which detects and blocks requests with urls containing `/../`."}, {"lang": "es", "value": "Vendure es una plataforma de comercio sin interfaz gr\u00e1fica de c\u00f3digo abierto. Antes de las versiones 3.0.5 y 2.3.3, una vulnerabilidad en el complemento de servidor de activos de Vendure permit\u00eda a un atacante crear una solicitud que pudiera atravesar el sistema de archivos del servidor y recuperar el contenido de archivos arbitrarios, incluidos datos confidenciales como archivos de configuraci\u00f3n, variables de entorno y otros datos cr\u00edticos almacenados en el servidor. En la misma ruta de c\u00f3digo hay un vector adicional para hacer que el servidor se bloquee mediante una URL mal formada. Hay parches disponibles en las versiones 3.0.5 y 2.3.3. Tambi\u00e9n hay algunos workarounds disponibles. Se puede utilizar el almacenamiento de objetos en lugar del sistema de archivos local, por ejemplo, MinIO o S3, o definir un middleware que detecte y bloquee las solicitudes con URL que contengan `/../`."}], "lastModified": "2024-10-16T16:38:43.170", "sourceIdentifier": "security-advisories@github.com"}