CVE-2023-46496
📋 TL;DR
A directory traversal vulnerability in EverShop NPM allows remote attackers to access sensitive files outside the intended directory via crafted DELETE requests to the api/files endpoint. This affects all EverShop installations using versions before 1.0.0-rc.8. Attackers can potentially read arbitrary files on the server.
💻 Affected Systems
- EverShop
📦 What is this software?
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
Evershop by Evershop
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files, credentials, or source code, potentially leading to further attacks.
Likely Case
Unauthorized access to sensitive files containing configuration data, user information, or application secrets.
If Mitigated
Limited impact with proper file permissions, network segmentation, and input validation in place.
🎯 Exploit Status
Exploitation requires sending crafted HTTP DELETE requests with directory traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0-rc.8 and later
Vendor Advisory: https://devhub.checkmarx.com/cve-details/CVE-2023-46496/
Restart Required: Yes
Instructions:
1. Update EverShop to version 1.0.0-rc.8 or later using npm update evershop. 2. Restart the EverShop application. 3. Verify the update was successful.
🔧 Temporary Workarounds
Block DELETE requests to api/files endpoint
allConfigure web application firewall or reverse proxy to block DELETE requests to the vulnerable endpoint.
# Example nginx configuration
location /api/files {
limit_except GET POST PUT { deny all; }
}
Implement input validation middleware
allAdd middleware to sanitize and validate file path parameters before processing.
// Example Express middleware
app.use('/api/files', (req, res, next) => {
if (req.params.path && req.params.path.includes('..')) {
return res.status(400).send('Invalid path');
}
next();
});
🧯 If You Can't Patch
- Implement strict file system permissions to limit accessible directories
- Deploy network segmentation to isolate EverShop from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check package.json for EverShop version. If version is below 1.0.0-rc.8, the system is vulnerable.Check Version:
npm list evershop | grep evershopVerify Fix Applied:
After updating, verify the version is 1.0.0-rc.8 or higher and test that directory traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP DELETE requests to /api/files with '..' sequences
- Failed file access attempts outside expected directories
Network Indicators:
- Unusual patterns of DELETE requests to file endpoints
- Requests with encoded directory traversal sequences
SIEM Query:
method=DELETE AND uri_path="/api/files" AND (uri_query="*..*" OR user_agent="*..*")