CVE-2024-22207 (published 2024-01-15T16:15Z)

fastify-swagger-ui is a Fastify plugin for serving Swagger UI.  Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module.  The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-1188
cwe_name: Initialization of a Resource with an Insecure Default
description: The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
extended_description: Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value.  However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.
	 
         

Fix information:
repo_url: https://github.com/fastify/fastify-swagger-ui
commit_details: repo_url: https://github.com/fastify/fastify-swagger-ui
author: Matteo Collina
author_date: 2024-01-15 14:57:58+01:00
msg: Merge pull request from GHSA-62jr-84gf-wmg4

Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Nick O'Leary <nick.oleary@gmail.com>
repository: repo_url: https://github.com/fastify/fastify-swagger-ui
repo_name: fastify/fastify-swagger-ui
description: Serve Swagger-UI for Fastify
repo_language: JavaScript
owner: fastify
file_changes: filename: routes.js
change_type: ModificationType.MODIFY
diff: @@ -207,22 +207,24 @@ function fastifySwagger (fastify, opts, done) {
     decorateReply: false
   })
 
-  fastify.register(fastifyStatic, {
-    root: opts.baseDir || path.join(__dirname, '..'),
-    serve: false
-  })
+  if (opts.baseDir) {
+    fastify.register(fastifyStatic, {
+      root: opts.baseDir,
+      serve: false
+    })
 
-  // Handler for external documentation files passed via $ref
-  fastify.route({
-    url: '/*',
-    method: 'GET',
-    schema: { hide: true },
-    ...hooks,
-    handler: function (req, reply) {
-      const file = req.params['*']
-      reply.sendFile(file)
-    }
-  })
+    // Handler for external documentation files passed via $ref
+    fastify.route({
+      url: '/*',
+      method: 'GET',
+      schema: { hide: true },
+      ...hooks,
+      handler: function (req, reply) {
+        const file = req.params['*']
+        reply.sendFile(file)
+      }
+    })
+  }
 
   done()
 }

programming_language: JavaScript
filename: route.test.js
change_type: ModificationType.MODIFY
diff: @@ -495,6 +495,19 @@ test('/documentation/ should redirect to ./static/index.html', async (t) => {
   t.equal(res.headers.location, './static/index.html')
 })
 
+test('/documentation/* should not return module files when baseDir not set', async (t) => {
+  t.plan(1)
+  const fastify = Fastify()
+  await fastify.register(fastifySwagger, swaggerOption)
+  await fastify.register(fastifySwaggerUi)
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/documentation/README.md'
+  })
+  t.equal(res.statusCode, 404)
+})
+
 test('should return silent log level of route /documentation', async (t) => {
   const fastify = Fastify()
 

programming_language: JavaScript