Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 3 October 2024.

Which products and versions are affected?

@saltcorn/server (npm) SEMVER:introduced=0,fixed=1.0.0-beta.14.

Is there a fix for This vulnerability?

Yes. @saltcorn/server (npm): upgrade to 1.0.0-beta.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run @saltcorn/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Saltcorn Server arbitrary file and directory listing via build mobile app

Severity: low · CVSS 3.1 · Published 2024-10-03

Saltcorn is an open-source web development platform used to build database applications and mobile apps. An authenticated administrator can exploit an unvalidated parameter in the mobile app build feature to list arbitrary filenames and directory names on the server's filesystem, potentially exposing sensitive naming conventions or structure without being able to read file contents.

Technologies: @saltcorn/server (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 3 October 2024.
Which products and versions are affected?: @saltcorn/server (npm) SEMVER:introduced=0,fixed=1.0.0-beta.14.
Is there a fix for This vulnerability?: Yes. @saltcorn/server (npm): upgrade to 1.0.0-beta.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run @saltcorn/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@saltcorn/server (npm): upgrade to 1.0.0-beta.14 or later
```
npm install @saltcorn/server@1.0.0-beta.14
```

Technical details

This is a path traversal and directory listing vulnerability (CWE-548) in the /admin/build-mobile-app/result endpoint. The build_dir_name query parameter is not validated before being used in a path.join() call to construct a directory path, which is then read with readdirSync(). An attacker can supply path traversal sequences (e.g., /../../../../../../../../) to escape the intended mobile_app directory and enumerate files in arbitrary locations. The vulnerability requires admin privileges and allows reading only filenames and directory names, not file contents. The fix validates the build_dir_name parameter format and verifies that the resolved buildDir path starts with the intended root location.

Affected products

Saltcorn @saltcorn/server <=1.0.0-beta.13

Timeline

2024-10-03: disclosed
2024-10-03: patched: Fixed in version 1.0.0-beta.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.