Executive brief
marked-tree is a markdown viewer used in development environments. A path traversal vulnerability in its file reading function allows unauthenticated attackers to read sensitive files from the server's filesystem, including configuration, source code, and system files, compromising data confidentiality.
Technical details
marked-tree contains a path traversal vulnerability (CWE-22) in the fs.readFile function within index.js, where user-supplied file paths are not sanitized. An attacker can exploit this via network requests using "../" sequences or absolute paths to access files outside the intended directory. The vulnerability requires no authentication, user interaction, or special access conditions. A successful exploit grants read access to arbitrary files on the system. No fixed version has been released; the vulnerability affects all versions up to and including 0.8.1.
Affected products
- marked-tree marked-tree all versions up to and including 0.8.1
Timeline
- 2020-06-20: disclosed
- 2021-05-07: advisory