Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. webcrack
  4. ›
  5. GHSA-ccqh-278p-xq6w

GHSA-ccqh-278p-xq6w: webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle

August 14, 2024

An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using the unpack bundles feature in conjunction with the saving feature. If a module name includes a path traversal sequence with Windows path separators, an attacker can exploit this to overwrite files on the host system.

References

  • github.com/advisories/GHSA-ccqh-278p-xq6w
  • github.com/j4k0xb/webcrack
  • github.com/j4k0xb/webcrack/blob/241f9469e6401f3dabc6373233d85a5e76966b54/packages/webcrack/src/unpack/bundle.ts
  • github.com/j4k0xb/webcrack/commit/4bc5c6f353012ee7edc2cb39d01a728ab7426999
  • github.com/j4k0xb/webcrack/security/advisories/GHSA-ccqh-278p-xq6w

Code Behaviors & Features

Detect and mitigate GHSA-ccqh-278p-xq6w with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 2.14.1

Fixed versions

  • 2.14.1

Solution

Upgrade to version 2.14.1 or above.

Impact 7.7 HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Source file

npm/webcrack/GHSA-ccqh-278p-xq6w.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:32 +0000.