Using vulnerable dependencies in package.json in star7th/showdoc

Valid

Reported on

Mar 18th 2022


Description

  1. Hello team, The Showdoc is using a axios 0.17.1 dependency that is vulnerable to:👇
1. CVE-2021-3749 Regular Expression Denial of Service (ReDoS)
2. CVE-2020-28168 Server-Side Request Forgery (SSRF)
3. CVE-2019-10742 Denial of Service (DoS)

Path to the file:

https://github.com/star7th/showdoc/blob/3caa32334db0c277b84e993eaca2036f5d1dbef8/web_src/package.json#L17

Reference:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3749
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28168
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10742

Patch recommendation:

  1. Update the axios 0.17.1 to axios 0.21.3
We are processing your report and will contact the star7th/showdoc team within 24 hours. 2 months ago
We have contacted a member of the star7th/showdoc team and are waiting to hear back 2 months ago
star7th validated this vulnerability 2 months ago
Akshay Ravi has been awarded the disclosure bounty
The fix bounty is now up for grabs
star7th confirmed that a fix has been merged on 39b82c 2 months ago
star7th has been awarded the fix bounty
Jamie Slome
2 months ago

Admin


Hi both 👋

The bounties have been zeroed out here, as our disclosure policy does not allow rewards for vulnerabilities in dependencies that are consumed as part of a library or repository. The vulnerability must be in the package/repository itself, i.e. in star7th/showdoc.

Let me know if you have any questions 👍

Akshay Ravi
2 months ago

Researcher


😒

to join this conversation