CVE-2024-22207: Default swagger-ui configuration exposes all files in the module
Impact
The default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module.
Patches
Update to v2.1.0
Workarounds
Use the baseDir option
References
HackerOne report .
Other sources
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the baseDir option can also work around this vulnerability.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22207?
CVE-2024-22207 is considered a high-severity vulnerability due to the risk of unauthorized file exposure.
How do I fix CVE-2024-22207?
To fix CVE-2024-22207, update to version 2.1.0 of the @fastify/swagger-ui package.
What is the impact of CVE-2024-22207?
The default configuration of @fastify/swagger-ui allows all files in its directory to be exposed via HTTP routes, leading to potential data leakage.
How can I mitigate CVE-2024-22207 without updating?
You can mitigate CVE-2024-22207 by setting the `baseDir` option in the configuration of @fastify/swagger-ui.
Which versions are affected by CVE-2024-22207?
Versions of @fastify/swagger-ui between 2.0.0 and 2.1.0 are affected by CVE-2024-22207.