Executive brief
gatsby-plugin-sharp is a Gatsby plugin for optimizing images in static websites. When running the Gatsby develop server, an attacker with access to the server can use path traversal to read arbitrary files from the underlying system. By default, the server listens only on localhost, but if an administrator exposes it to untrusted networks, sensitive files like configuration data or credentials could be accessed.
Technical details
This is a path traversal vulnerability (CWE-22) in the gatsby-plugin-sharp plugin exposed through the Gatsby develop server. The vulnerable code fails to properly validate or sanitize file paths, allowing attackers to use directory traversal sequences (../) to escape the intended project directory. The attack vector is network-based and requires low privileges (the attacker must have network access to the develop server), with no user interaction needed. An attacker can read arbitrary files accessible to the server process. Patches have been released in versions 5.8.1 and 4.25.1 that ensure paths remain within the project directory.
Affected products
- Gatsby gatsby-plugin-sharp <5.8.1, <4.25.1
Timeline
- 2023-04-17: disclosed
- 2023-04-20: patched: gatsby-plugin-sharp 5.8.1 and 4.25.1 released