GitHub Advisoryadvisory · npm

GHSA-5h5v-hw44-f6gg Oceanic allows unsanitized user input to lead to path traversal in URLs

MEDIUM Published 2024-05-14 Modified 2024-05-14 Official page ↗
Aliases
CVE-2024-34712
Ecosystem
npm
Packages
oceanic.js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-22, CWE-23
Reviewed
2024-05-14

Affected packages

• npm oceanic.js: < 1.10.4 → fixed in 1.10.4

Description

Impact Input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban. Workarounds • Sanitizing user input, ensuring strings are valid for the purpose they are being used for. • Encoding input with `encodeURIComponent` before providing it to the library. References OceanicJS/Oceanic@8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe

Related

Alias · CVE (1)

  • CVE-2024-34712 Oceanic is a NodeJS library for interfacing with Discord. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-23 Relative Path Traversal weakness

References