GHSA-62jr-84gf-wmg4
Default swagger-ui configuration exposes all files in the module
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @fastify/swagger-ui | >= 2.0.0, < 2.1.0 | 2.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module.
### Patches
Update to v2.1.0
### Workarounds
Use the `baseDir` option
### References
[HackerOne report
](https://hackerone.com/reports/2312369).
References
External links from the advisory. They lead to third-party sites.
- https://github.com/fastify/fastify-swagger-ui/security/advisories/GHSA-62jr-84gf-wmg4
- https://nvd.nist.gov/vuln/detail/CVE-2024-22207
- https://github.com/fastify/fastify-swagger-ui/commit/13d799a2c5f14d3dd5b15892e03bbcbae63ee6f7
- https://github.com/fastify/fastify-swagger-ui
- https://security.netapp.com/advisory/ntap-20240216-0002