Is CVE-2018-3717 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-3717 being exploited in the wild.

How severe is CVE-2018-3717?

Low severity, with a CVSS score of 3.1, published 26 July 2018.

Which products and versions are affected?

connect (npm) SEMVER:introduced=0,fixed=2.14.0.

Is there a fix for CVE-2018-3717?

Yes. connect (npm): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-3717 attacked?

It is attacked over the network.

Am I affected by CVE-2018-3717?

Check whether you run connect (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-3717: connect Cross-Site Scripting in directory middleware

CVE-2018-3717 · Severity: low · CVSS 3.1 · Published 2018-07-26

connect is a popular Node.js middleware framework used to build web applications and APIs. A Cross-Site Scripting (XSS) vulnerability in the directory listing middleware allows attackers to inject malicious scripts into responses when serving directory listings, potentially compromising end-user browsers and enabling session hijacking or credential theft.

Vendors: npm.

Quick answers

Is CVE-2018-3717 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-3717 being exploited in the wild.
How severe is CVE-2018-3717?: Low severity, with a CVSS score of 3.1, published 26 July 2018.
Which products and versions are affected?: connect (npm) SEMVER:introduced=0,fixed=2.14.0.
Is there a fix for CVE-2018-3717?: Yes. connect (npm): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-3717 attacked?: It is attacked over the network.
Am I affected by CVE-2018-3717?: Check whether you run connect (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

connect (npm): upgrade to 2.14.0 or later
```
npm install connect@2.14.0
```

Technical details

The connect node module before version 2.14.0 contains a Cross-Site Scripting (CWE-79) vulnerability in the directory.js middleware due to insufficient validation and encoding of file path parameters. The vulnerability is network-reachable and requires user interaction (victim viewing a crafted directory listing), but does not require authentication. An attacker can craft a malicious filename or path containing JavaScript code that is reflected in the directory listing HTML without proper escaping, allowing script execution in the victim's browser. The vulnerability has been fixed in version 2.14.0 and later.

Affected products

Node.js connect before 2.14.0

Identifiers

CVE-2018-3717
GHSA-rch9-xh7r-mqgw

Timeline

2018-06-07: disclosed
2018-07-26: patched: Version 2.14.0 released with fix

References

https://github.com/JacksonTian/anywhere/issues/33

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.