Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 12 March 2021.

Which products and versions are affected?

Highcharts Export Server <=2.0.30; highcharts-export-server (npm) SEMVER:introduced=0,fixed=2.1.0.

Is there a fix for This vulnerability?

Yes. highcharts-export-server (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run Highcharts Export Server or highcharts-export-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Highcharts Export Server HTTP resource disclosure

Q: Is there a fix for This vulnerability?

Yes. highcharts-export-server (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network.

Q: Am I affected?

Check whether you run Highcharts Export Server or highcharts-export-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: info · Published 2021-03-12

Highcharts Export Server is a Node.js utility that generates chart images and PDFs from Highcharts JavaScript charts. A vulnerability allows attackers to read files served by internal HTTP services on the same network if they can access the export server, potentially exposing internal web applications, databases, and configuration files. This risk is heightened if the export server is exposed to the internet.

Vendors: Highcharts, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 12 March 2021.
Which products and versions are affected?: Highcharts Export Server <=2.0.30; highcharts-export-server (npm) SEMVER:introduced=0,fixed=2.1.0.
Is there a fix for This vulnerability?: Yes. highcharts-export-server (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run Highcharts Export Server or highcharts-export-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

highcharts-export-server (npm): upgrade to 2.1.0 or later
```
npm install highcharts-export-server@2.1.0
```

Technical details

The vulnerability is an insecure resource access flaw (CWE-552) that allows an attacker to specify arbitrary internal hostnames or IP addresses to read HTTP-served resources. The root cause is insufficient input validation when the export server processes requests to fetch remote resources. An attacker with network access to the export server can exploit this by crafting requests that target internal services, bypassing network segmentation. The attack requires knowledge of internal hostnames or IP addresses but does not require authentication. Version 2.1.0 and later address this issue, though a major version upgrade is required for full security.

Affected products

Highcharts Export Server <=2.0.30

Timeline

2021-03-12: disclosed
2021-03-12: patched: Version 2.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.