GHSA-cfqx-f43m-vfh7
MEDIUM@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
Blast Radius
@saltcorn/serverReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A user with admin permission can read arbitrary file and directory names on the filesystem by calling the admin/build-mobile-app/result?build_dir_name= endpoint. The build_dir_name parameter is not properly validated and it's then used to construct the buildDir that is read. The file/directory names under the buildDir will be returned.
Details
- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L2884-L2893
router.get(
"/build-mobile-app/result",
isAdmin,
error_catcher(async (req, res) => {
const { build_dir_name } = req.query; // [1] source
const rootFolder = await File.rootFolder();
const buildDir = path.join(
rootFolder.location,
"mobile_app",
build_dir_name // [2]
);
const files = await Promise.all(
fs
.readdirSync(buildDir) // [3] sink
.map(async (outFile) => await File.from_file_on_disk(outFile, buildDir))
);
[...]
})
);
PoC
- log into the application as an admin user
- visit the following url:
http://localhost:3000/admin/build-mobile-app/result?build_dir_name=/../../../../../../../../
NOTE: it's possible to only see file and directory names but not to download their content.
Impact
Information disclosure
Recommended Mitigation
Resolve the buildDir and check if it starts with ${rootFolder.location}/mobile_app.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @saltcorn/server | all versions | 1.0.0-beta.14 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @saltcorn/server. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update @saltcorn/server to 1.0.0-beta.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cfqx-f43m-vfh7 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-cfqx-f43m-vfh7 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-cfqx-f43m-vfh7. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-cfqx-f43m-vfh7 in your dependencies?
O3 detects GHSA-cfqx-f43m-vfh7 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.