GHSA-VXJG-HCHX-CC4G

Vulnerability from github – Published: 2023-08-01 16:59 – Updated: 2023-08-04 18:41
VLAI
Summary
@simonsmith/cypress-image-snapshothas fix for insecure snapshot file names
Details

Impact

It's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example:

  cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs')

The above will create an ignore-relative-dirs.png three levels up

Patches

Fixed in 8.0.2

Workarounds

Validate all the existing uses of matchImageSnapshot to ensure correct use of the filename argument. Example:

    // snapshot name will be the test title
    cy.matchImageSnapshot();

    // snapshot name will be the name passed in
    cy.matchImageSnapshot('login');

References

https://github.com/simonsmith/cypress-image-snapshot/issues/15

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@simonsmith/cypress-image-snapshot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-38695"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-01T16:59:40Z",
    "nvd_published_at": "2023-08-04T18:15:14Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIt\u0027s possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example:\n\n```js\n  cy.get(\u0027h1\u0027).matchImageSnapshot(\u0027../../../ignore-relative-dirs\u0027)\n```\nThe above will create an `ignore-relative-dirs.png` three levels up\n\n### Patches\nFixed in `8.0.2`\n\n### Workarounds\nValidate all the existing uses of `matchImageSnapshot` to ensure correct use of the filename argument. Example:\n\n```js\n    // snapshot name will be the test title\n    cy.matchImageSnapshot();\n\n    // snapshot name will be the name passed in\n    cy.matchImageSnapshot(\u0027login\u0027);\n```\n\n### References\nhttps://github.com/simonsmith/cypress-image-snapshot/issues/15\n",
  "id": "GHSA-vxjg-hchx-cc4g",
  "modified": "2023-08-04T18:41:47Z",
  "published": "2023-08-01T16:59:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/simonsmith/cypress-image-snapshot/security/advisories/GHSA-vxjg-hchx-cc4g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38695"
    },
    {
      "type": "WEB",
      "url": "https://github.com/simonsmith/cypress-image-snapshot/issues/15"
    },
    {
      "type": "WEB",
      "url": "https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/simonsmith/cypress-image-snapshot"
    },
    {
      "type": "WEB",
      "url": "https://github.com/simonsmith/cypress-image-snapshot/releases/tag/8.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@simonsmith/cypress-image-snapshothas fix for insecure snapshot file names"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.