Path Traversal in ssr-pages

Vulnerability

In ssr-pages, an HTML page builder for server-side rendering, versions prior to 0.1.4 are vulnerable to a path traversal issue. The vulnerability occurs when untrusted input is supplied to the svg property as an argument to the build(MessagePageOptions) function. This allows an attacker to traverse directories and potentially read arbitrary files on the server. [1]

Exploitation

An attacker can exploit this by providing a malicious svg value containing path traversal sequences (e.g., ../) to the build function. No authentication or special privileges are mentioned; the attacker only needs to be able to supply input to the svg property. The exact sequence of steps is not detailed in the available reference, but the path traversal is triggered during the page building process. [1]

Impact

Successful exploitation could lead to unauthorized disclosure of sensitive files on the server, such as configuration files or source code, depending on the server's file system permissions. The impact is limited to information disclosure; no remote code execution or privilege escalation is indicated. [1]

Mitigation

The vulnerability is patched in version 0.1.4 of ssr-pages. Users should upgrade to this version or later. No workaround is known at the time of publication. [1]