PT-2023-22774 · Gatsby · Gatsby-Plugin-Sharp
Bart Veneman
+1
·
Published
2023-04-17
·
Updated
2023-04-27
·
CVE-2023-30548
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
gatsby-plugin-sharp versions prior to 5.8.1 and 4.25.1
Description
The gatsby-plugin-sharp plugin contains a path traversal vulnerability exposed when running the Gatsby develop server (
gatsby develop). By default, gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability. Attackers exploiting this vulnerability will have read access to all files within the scope of the server process.Recommendations
To resolve the issue, upgrade to gatsby-plugin-sharp@5.8.1 or gatsby-plugin-sharp@4.25.1.
For those using the develop server in the default configuration, no action is required as no risk is posed.
If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.
As a temporary workaround, consider restricting access to the develop server to minimize the risk of exploitation.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gatsby-Plugin-Sharp