Executive brief
Vendure's asset server plugin allows attackers to read arbitrary files from the server's filesystem when using local file storage. An attacker can craft specially-formed requests to bypass path security and access sensitive data like configuration files and credentials, or crash the service entirely via malformed requests. This directly exposes confidential business data and compromises system availability.
Technical details
The vulnerability is a path traversal (CWE-22) issue stemming from improper input validation (CWE-20). The AssetServerPlugin directly uses a decoded request path in path.join() without path normalization, allowing attackers to inject traversal sequences like "../" to access files outside the intended asset directory. An unauthenticated, remote attacker can send a crafted HTTP request (e.g., curl --path-as-is http://localhost:3000/assets/../package.json) to retrieve arbitrary files. Additionally, the code calls decodeURIComponent() on untrusted input without error handling, allowing malformed URI-encoded characters to crash the Node.js process with a URIError, enabling denial of service. Patches are available in versions 2.3.3 and 3.0.5.
Affected products
- Vendure asset-server-plugin prior to 2.3.3 and 3.0.5
Timeline
- 2024-10-15: disclosed: GHSA-r9mq-3c9r-fmjq and CVE-2024-48914 published
- 2024-10-15: patched: Versions 2.3.3 and 3.0.5 released with fix