GitHub Advisoryadvisory · npm
GHSA-393x-fr59-r8fg statics-server Cross-site Scripting vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2018-3771
- Ecosystem
- npm
- Packages
- statics-server
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-04-22
Affected packages
• npm statics-server: <= 0.0.9 (no fix yet)
Description
An XSS in statics-server ` element without escaping, which allows to embed HTML `` tag with `src` attribute points to another HTML file in the directory. This file can contain malicious JavaScript code, which will be executed:
```js
// ./node_modules/statics-server/index.js, line 18:
if(fs.lstatSync(staticPath).isDirectory()){
var files=fs.readdirSync(staticPath);
var lis='';
files.forEach((v,i)=>{
if(fs.lstatSync(path.resolve(staticPath,v)).isDirectory()){
lis+=`${v}/`;
}else {
lis+=`${v}`
}
});
(...)
```
Related
Alias · CVE (1)
- CVE-2018-3771 An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness