Executive brief
EverShop is a TypeScript-based e-commerce platform. A directory traversal vulnerability in its file browser API allows unauthenticated attackers to list files and directories on the server's filesystem, potentially exposing application source code, configuration files, and other sensitive data. The flaw stems from missing input validation in file path handling.
Technical details
A path traversal vulnerability (CWE-22) exists in EverShop versions before 1.0.0-rc.8 in the readDirSync function within fileBrowser/browser.js. The /api/files API endpoint accepts user-supplied input without proper validation, allowing attackers to craft requests using relative path sequences (e.g., ../) to traverse the filesystem and enumerate arbitrary directories and files. The vulnerability requires no authentication and can be exploited from the network. An attacker can leverage this to discover sensitive files such as application credentials, source code, configuration data, and system files, compromising the confidentiality of the application and potentially aiding further attacks. A patch is available in version 1.0.0-rc.8 and later.
Affected products
- EverShop @evershop/evershop < 1.0.0-rc.8
Timeline
- 2023-12-08: disclosed: Published on OSV and NVD
- 2023-09-27: patched: Fix merged in PR #338; released in version 1.0.0-rc.8