Executive brief
atompm is a Node.js package used for package management and file downloads. Versions prior to 0.8.2 fail to properly validate relative paths in download URLs, allowing attackers to download arbitrary files from the server, potentially exposing sensitive configuration files, private keys, or other confidential data stored on the system.
Technical details
This vulnerability is a path traversal / directory traversal flaw (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the file download functionality of atompm. The package fails to sanitize relative path sequences (such as "../") in the URL parameter used for file downloads, allowing an attacker to navigate outside the intended download directory and access arbitrary files on the filesystem. The attack is network-accessible without authentication. An attacker can exploit this to read sensitive files. The fix is available in version 0.8.2 and later.
Affected products
- npm atompm prior to 0.8.2
Timeline
- 2020-09-11: disclosed
- 2020-09-11: patched: version 0.8.2 released