CVE-2022-1044 (JavaScript, published 2022-05-12T08:15Z)
Description: value: Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-922 \u2014 Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Repository: https://github.com/polonel/trudesk
Files changed:
package.json
src/controllers/accounts.js
src/helpers/utils/index.js
yarn.lock
Commit message: fix(uploads): removal of EXIF data on profile picture uploads

Vulnerable code:
  var fs = require('fs')
  var path = require('path')
  var Busboy = require('busboy')
  var busboy = Busboy({
  var object = {}
  var error
    var savePath = path.join(__dirname, '../../public/uploads/users')
abbrev@1.0.x:
  version "1.0.9"
  resolved "https://registry.yarnpkg.com/abbrev/-/abbrev-1.0.9.tgz#91b4792588a7738c25f35dd6f63752a2f8776135"
  integrity sha1-kbR5JYinc4wl813W9jdSovh3YTU=

async@1.x, async@^1.4.0:
  version "1.5.2"
  resolved "https://registry.yarnpkg.com/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"
  integrity sha1-7GphrlZIDAw8skHJVhjiCJL5Zyo=

async@^2.5.0, async@^2.6.0:
escodegen@1.8.x:
  version "1.8.1"
  resolved "https://registry.yarnpkg.com/escodegen/-/escodegen-1.8.1.tgz#5a5b53af4693110bebb0867aa3430dd3b70a1018"
  integrity sha1-WltTr0aTEQvrsIZ6o0MN07cKEBg=
  dependencies:
    esprima "^2.7.1"
    estraverse "^1.9.1"
    esutils "^2.0.2"
    optionator "^0.8.1"
  optionalDependencies:
    source-map "~0.2.0"

esprima@2.7.x, esprima@^2.7.1:
  version "2.7.3"
  resolved "https://registry.yarnpkg.com/esprima/-/esprima-2.7.3.tgz#96e3b70d5779f6ad49cd032673d1c312767ba581"
  integrity sha1-luO3DVd59q1JzQMmc9HDEnZ7pYE=

estraverse@^1.9.1:
  version "1.9.3"
  resolved "https://registry.yarnpkg.com/estraverse/-/estraverse-1.9.3.tgz#af67f2dc922582415950926091a4005d29c9bb44"
  integrity sha1-r2fy3JIlgkFZUJJgkaQAXSnJu0Q=

glob@5.0.15, glob@^5.0.15, glob@~5.0.0:
handlebars@^4.0.1:
  version "4.0.12"
  resolved "https://registry.yarnpkg.com/handlebars/-/handlebars-4.0.12.tgz#2c15c8a96d46da5e266700518ba8cb8d919d5bc5"
  integrity sha512-RhmTekP+FZL+XNhwS1Wf+bTTZpdLougwt5pcgA1tuz6Jcx0fpH/7z0qd71RKnZHBCxIRBHfBOnio4gViPemNzA==
  dependencies:
    async "^2.5.0"
    optimist "^0.6.1"
    source-map "^0.6.1"
  optionalDependencies:
    uglify-js "^3.1.4"

istanbul@0.4.5:
  version "0.4.5"
  resolved "https://registry.yarnpkg.com/istanbul/-/istanbul-0.4.5.tgz#65c7d73d4c4da84d4f3ac310b918fb0b8033733b"
  integrity sha1-ZcfXPUxNqE1POsMQuRj7C4Azczs=
  dependencies:
    abbrev "1.0.x"
    async "1.x"
    escodegen "1.8.x"
    esprima "2.7.x"
    glob "^5.0.15"
    handlebars "^4.0.1"
    js-yaml "3.x"
    mkdirp "0.5.x"
    nopt "3.x"
    once "1.x"
    resolve "1.1.x"
    supports-color "^3.1.0"
    which "^1.1.1"
    wordwrap "^1.0.0"

js-yaml@3.x:
  version "3.12.1"
  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.12.1.tgz#295c8632a18a23e054cf5c9d3cecafe678167600"
  integrity sha512-um46hB9wNOKlwkHgiuyEVAybXBjwFUV0Z/RaHJblRd9DXltue9FTYvzCr9ErQrK9Adz5MU4gHWVaNUfdmrC8qA==
  dependencies:
    argparse "^1.0.7"
    esprima "^4.0.0"

minimist@~0.0.1:
  version "0.0.10"
  resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.0.10.tgz#de3f98543dbf96082be48ad1a0c7cda836301dcf"
  integrity sha1-3j+YVD2/lggr5IrRoMfNqDYwHc8=

mkdirp@0.5.x, "mkdirp@>=0.5 0", mkdirp@^0.5.1:
mkdirp@1.0.4, mkdirp@^1.0.3, mkdirp@^1.0.4, mkdirp@~1.0.4:
  version "1.0.4"
  resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-1.0.4.tgz#3eb5ed62622756d79a5f0e2a221dfebad75c2f7e"
  integrity sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==

nopt@3.x, nopt@~3.0.6:
  version "3.0.6"
  resolved "https://registry.yarnpkg.com/nopt/-/nopt-3.0.6.tgz#c6465dbf08abcd4db359317f79ac68a646b28ff9"
  integrity sha1-xkZdvwirzU2zWTF/eaxopkayj/k=
  dependencies:
    abbrev "1"

once@1.4.0, once@1.x, once@^1.3.0, once@^1.3.1, once@^1.4.0:
optimist@^0.6.1:
  version "0.6.1"
  resolved "https://registry.yarnpkg.com/optimist/-/optimist-0.6.1.tgz#da3ea74686fa21a19a111c326e90eb15a0196686"
  integrity sha1-2j6nRob6IaGaERwybpDrFaAZZoY=
  dependencies:
    minimist "~0.0.1"
    wordwrap "~0.0.2"

resolve@1.1.7, resolve@1.1.x:
source-map@~0.2.0:
  version "0.2.0"
  resolved "https://registry.yarnpkg.com/source-map/-/source-map-0.2.0.tgz#dab73fbcfc2ba819b4de03bd6f6eaa48164b3f9d"
  integrity sha1-2rc/vPwrqBm03gO9b26qSBZLP50=
  dependencies:
    amdefine ">=0.0.4"

supports-color@^3.1.0, supports-color@^3.2.3:
which@^1.1.1, which@^1.2.14, which@^1.2.9:
wordwrap@~0.0.2:
  version "0.0.3"
  resolved "https://registry.yarnpkg.com/wordwrap/-/wordwrap-0.0.3.tgz#a3d5da6cd5c0bc0008d37234bbaf1bed63059107"
  integrity sha1-o9XabNXAvAAI03I0u68b7WMFkQc=


Fixed code:
    "piexifjs": "1.0.6",
  const fs = require('fs')
  const path = require('path')
  const Busboy = require('busboy')
  const busboy = Busboy({
  const object = {}
  let error
    const savePath = path.join(__dirname, '../../public/uploads/users')
    if (path.extname(object.filename) === '.jpg' || path.extname(object.filename) === '.jpeg') {
      require('../helpers/utils').stripExifData(object.filePath)
    }
const fs = require('fs')
const piexifjs = require('piexifjs')
module.exports.stripExifData = function (path) {
  const fs = require('fs')
  const piexifjs = require('piexifjs')

  const imgData = fs.readFileSync(path).toString('binary')
  const newImgData = piexifjs.remove(imgData)
  fs.writeFileSync(path, newImgData, 'binary')
}

async@^1.4.0:
  version "1.5.2"
  resolved "https://registry.yarnpkg.com/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"
  integrity sha1-7GphrlZIDAw8skHJVhjiCJL5Zyo=

async@^2.6.0:
glob@5.0.15, glob@~5.0.0:
mkdirp@1.0.4, mkdirp@^1.0.3, mkdirp@^1.0.4, mkdirp@~1.0.4:
  version "1.0.4"
  resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-1.0.4.tgz#3eb5ed62622756d79a5f0e2a221dfebad75c2f7e"
  integrity sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==

"mkdirp@>=0.5 0", mkdirp@^0.5.1:
nopt@~3.0.6:
  version "3.0.6"
  resolved "https://registry.yarnpkg.com/nopt/-/nopt-3.0.6.tgz#c6465dbf08abcd4db359317f79ac68a646b28ff9"
  integrity sha1-xkZdvwirzU2zWTF/eaxopkayj/k=
  dependencies:
    abbrev "1"

once@1.4.0, once@^1.3.0, once@^1.3.1, once@^1.4.0:
piexifjs@1.0.6:
  version "1.0.6"
  resolved "https://registry.yarnpkg.com/piexifjs/-/piexifjs-1.0.6.tgz#883811d73f447218d0d06e9ed7866d04533e59e0"
  integrity sha512-0wVyH0cKohzBQ5Gi2V1BuxYpxWfxF3cSqfFXfPIpl5tl9XLS5z4ogqhUCD20AbHi0h9aJkqXNJnkVev6gwh2ag==

resolve@1.1.7:
supports-color@^3.2.3:
which@^1.2.14, which@^1.2.9: