Is CVE-2019-8903 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-8903 being exploited in the wild.

How severe is CVE-2019-8903?

Low severity, with a CVSS score of 3, published 20 February 2019.

Which products and versions are affected?

total.js (npm) SEMVER:introduced=0,fixed=3.2.3.

Is there a fix for CVE-2019-8903?

Yes. total.js (npm): upgrade to 3.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-8903 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-8903?

Check whether you run total.js (npm) or Total.js Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-8903: Total.js path traversal via insufficient URL sanitization

CVE-2019-8903 · Severity: low · CVSS 3 · Published 2019-02-20

Total.js is a popular Node.js framework used for building web applications and real-time services. A security flaw in how the framework handles web addresses allows unauthorized users to access files on the server that should be restricted. This could lead to the exposure of sensitive application data, configuration files, or source code, potentially compromising the security of the entire web platform.

Technologies: total.js (npm), Total.js Framework. Vendors: npm, Total.js.

Quick answers

Is CVE-2019-8903 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-8903 being exploited in the wild.
How severe is CVE-2019-8903?: Low severity, with a CVSS score of 3, published 20 February 2019.
Which products and versions are affected?: total.js (npm) SEMVER:introduced=0,fixed=3.2.3.
Is there a fix for CVE-2019-8903?: Yes. total.js (npm): upgrade to 3.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-8903 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-8903?: Check whether you run total.js (npm) or Total.js Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

total.js (npm): upgrade to 3.2.3 or later
```
npm install total.js@3.2.3
```

Technical details

A path traversal vulnerability exists in total.js (specifically within index.js) due to insufficient sanitization of URL pathnames. An unauthenticated remote attacker can use relative path sequences (e.g., '../') or URL-encoded equivalents (e.g., '%2e%2e%2f') to bypass directory restrictions and access files outside the '/public' folder. While the exploit is limited to specific file extensions (such as .js, .json, .txt, and .xml), it still allows for significant information disclosure. The issue was addressed by improving the validation logic in the request handling component to detect and block these sequences. Fixes are available in version 3.2.3 and various backported patches for older major versions.

Affected products

Total.js total.js < 3.2.3

Identifiers

CVE-2019-8903
GHSA-3q32-j57w-q4w7

Timeline

2019-02-18: advisory: NVD published CVE-2019-8903
2019-02-20: advisory: GitHub Advisory GHSA-3q32-j57w-q4w7 published
2019-02-18: patched: Fixes committed to totaljs/framework repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.