Executive brief
@finastra/ssr-pages is a Node.js library for server-side rendering of web pages. The vulnerability allows attackers with authenticated access to read sensitive files from the underlying server by crafting malicious SVG file paths, potentially exposing configuration files, source code, or other confidential data stored on the system.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in the build(MessagePageOptions) function that occurs when processing an untrusted svg property argument. An authenticated attacker can inject path traversal sequences (e.g., `../../../etc/passwd`) into the SVG property to access files outside the intended directory. The vulnerability requires the attacker to have permissions to call the affected function, but does not require user interaction. Successful exploitation enables arbitrary file read on the affected server. The vulnerability was fixed in version 0.1.4.
Affected products
- Finastra ssr-pages All versions before 0.1.4
Timeline
- 2022-03-01: disclosed
- 2022-03-01: patched: Fixed in version 0.1.4