PT-2024-28731 · Npm · @Jmondi/Url-To-Png

Realarcherl · Published 2024-07-15 · Updated 2024-07-16 · CVE-2024-39918

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @jmondi/url-to-png versions prior to 2.1.2

Description The issue arises from the lack of sanitization of the ImageId input in the code, leading to a path traversal vulnerability. This allows an attacker to store an image in an arbitrary location that the server has permission to access. The vulnerability is different from traditional path traversal issues, as it enables storing images in any location. There are no known workarounds for this issue.

Recommendations For versions prior to 2.1.2, upgrade to version 2.1.2 to address the issue. As a temporary workaround, consider sanitizing the ImageId input by removing special characters from the parameters, such as using the slugify function for the params. For example, modify the imageId assignment to const imageId = dateString + "." + slugify(validData.url) + slugify(configToString(params));. This will help prevent path traversal attacks until the official patch is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-39918

GHSA-VVMV-WRVP-9GJR

Affected Products

@Jmondi/Url-To-Png

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39918.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39918 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39918 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvmv-wrvp-9gjr · Vendor Advisory
• https://github.com/jasonraimondi/url-to-png/releases/tag/v2.1.2 · Note
• https://github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts#L75 · Note
• https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-vvmv-wrvp-9gjr · Note
• https://github.com/jasonraimondi/url-to-png · Note
• https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507 · Note
• https://t.me/cvedetector/902 · Telegram Post