Harp Module up to 0.29.0 on npm Server Rule Directory information disclosure

Summaryinfo

A vulnerability was found in Harp Module up to 0.29.0 on npm. It has been rated as problematic. This issue affects some unknown processing of the component Server Rule Handler. Performing a manipulation results in information disclosure (Directory). This vulnerability is cataloged as CVE-2019-5437. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Harp Module up to 0.29.0 on npm (NPM Package). This affects an unknown function of the component Server Rule Handler. The manipulation with an unknown input leads to a information disclosure vulnerability (Directory). CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge.

The bug was discovered 04/06/2019. The weakness was shared 05/10/2019. This vulnerability is uniquely identified as CVE-2019-5437 since 01/04/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 34 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-134590 is related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• NPM Package

Name

• Harp Module

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion