Executive brief
larvitbase-www is a Node.js web framework library used to build web applications. The library exposes API endpoints that pass unsanitized user input directly to file inclusion calls, allowing an attacker to execute arbitrary JavaScript files stored on the server. This could lead to complete application compromise and unauthorized code execution.
Technical details
larvitbase-www is vulnerable to an arbitrary file inclusion flaw due to improper input validation on GET parameters passed to require() calls. An attacker can manipulate the unsanitized parameter to execute any .js file in the directory where the server is running, without requiring authentication or special privileges. The vulnerability affects all versions of the package and the root cause is the direct use of user-supplied input in file inclusion functions. No patch is currently available; users are advised to migrate to alternative packages.
Affected products
- npm larvitbase-www all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory