GMS-2020-405: Unauthorized File Access in node-git-server
(updated )
Versions of node-git-server prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories.
References
- github.com/advisories/GHSA-cv3v-7846-6pxm
- github.com/gabrielcsapo/node-git-server/blob/0.2.0/lib/git.js
- github.com/gabrielcsapo/node-git-server/commit/ac26650f69bc445d71e4f2c55328676d10a4be43
- github.com/gabrielcsapo/node-git-server/commit/fb8d62710e3d78c796e04a33fcff66cea3f212f3
- github.com/gabrielcsapo/node-git-server/pull/62
- github.com/gabrielcsapo/node-git-server/tree/0.1.0
- snyk.io/vuln/SNYK-JS-NODEGITSERVER-474343
Code Behaviors & Features
Detect and mitigate GMS-2020-405 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →