CVE-2020-7646

CVE-2020-7646 affects the curlrequest npm package (versions through 1.0.1), which is a Node.js wrapper for the curl command-line tool. The vulnerability exists because the file option, intended for file uploads, is passed directly to the curl command without validation. This allows an attacker to supply an arbitrary file path, which curl then reads and returns the contents. The root cause is insufficient sanitization of user-controlled input in the file parameter [1][2].

Exploitation is straightforward: an attacker provides the file parameter with a path to a sensitive file, such as /etc/passwd. No authentication is required; the attack can be performed remotely if the application using curlrequest accepts user input for this parameter. According to the Snyk advisory, a proof-of-concept demonstrates reading /etc/passwd by simply setting { file: "/etc/passwd" } in the request options [3].

The impact is high because the attacker can read any file on the filesystem that the Node.js process has access to. This includes configuration files, source code, and other sensitive data. The Common Vulnerability Scoring System (CVSS) base score for this vulnerability is 9.1, indicating critical severity [2].

No patched version of curlrequest exists; the package appears to be unmaintained. The recommended mitigation is to avoid using the file parameter with untrusted input or to switch to a different library. As of the publication date, no workaround has been provided by the maintainer [1][3].