PT-2023-22774 · Gatsby · Gatsby-Plugin-Sharp
Bart Veneman
+1
·
Publicado
2023-04-17
·
Atualizado
2023-04-27
·
CVE-2023-30548
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
gatsby-plugin-sharp versions prior to 5.8.1 and 4.25.1
Description
The gatsby-plugin-sharp plugin contains a path traversal vulnerability exposed when running the Gatsby develop server (
gatsby develop). By default, gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability. Attackers exploiting this vulnerability will have read access to all files within the scope of the server process.Recommendations
To resolve the issue, upgrade to gatsby-plugin-sharp@5.8.1 or gatsby-plugin-sharp@4.25.1.
For those using the develop server in the default configuration, no action is required as no risk is posed.
If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.
As a temporary workaround, consider restricting access to the develop server to minimize the risk of exploitation.
Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Gatsby-Plugin-Sharp