GHSA-w7f9-wqc4-3wxr: Mockoon has a Path Traversal and LFI in the static file serving endpoint
(updated )
A mock API configuration for static file serving following the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal and LFI, allowing an attacker to get any file in the mock server filesystem. The issue may be particularly relevant in cloud hosted server instances
References
- github.com/advisories/GHSA-w7f9-wqc4-3wxr
- github.com/mockoon/mockoon
- github.com/mockoon/mockoon/blob/1ed31c4059d7f757f6cb2a43e10dc81b0d9c55a9/packages/commons-server/src/libs/server/server.ts
- github.com/mockoon/mockoon/blob/1ed31c4059d7f757f6cb2a43e10dc81b0d9c55a9/packages/commons-server/src/libs/server/server.ts
- github.com/mockoon/mockoon/commit/c7f6e23e87dc3b8cc44e5802af046200a797bd2e
- github.com/mockoon/mockoon/security/advisories/GHSA-w7f9-wqc4-3wxr
Code Behaviors & Features
Detect and mitigate GHSA-w7f9-wqc4-3wxr with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →