ScaffoldHub arbitrary file read vulnerability

When conducting a security code audit for one my clients, I found an arbitrary file read due to path traversal in scaffoldhub, the vulnerability is in the local file storage strategy.

I have fixed the vulnerability for my client since it was my first priority and then I responsibly disclosed this vulnerability to Felipe Lima the owner of the project on discord who acted quickly and in less than 2 hours patched [1] the issue and emailed his clients about the fix.

Felipe also kindly gave me a developer subscription to scaffoldhub so I guess I'm obliged to use it for my next web project!


[1] Felipe's patch: https://gist.github.com/felipepastorelima/46e78f4201c2efc803c276d0da0fc211

Comments

  1. Bet365 Casino Review for Canadian Players | 100% Bonus up to C$1600
    If 라스 벳 you 아시안부키 have ever tried out Bet365 casino for 원피스 바카라 your personal money and want to get started 7 포커 with a little bit of action and win a nice bonus, then you must know what you 🏆 Bet365 Casino: Claim 라이브채팅 Bonus🎁 Free Spins: Up to C$1000💻 Software provider: NetEnt, ‎Microgaming‎, ‎PayPal‎

    ReplyDelete
  2. BetMGM casino set to open in Arizona | KTNV
    Sports betting is now 밀양 출장샵 live in Arizona, with a sportsbook opening at 군산 출장마사지 BetMGM Casino Wynn and 서산 출장샵 Encore 제주 출장안마 are the current 수원 출장샵

    ReplyDelete
  3. Casino - Tricktoactoe
    Welcome to the hottest slots online, you are always going to find 슬롯 사이트 a good casino where you can play 스마일 토토 for real money without ever having to 사설토토 졸업 샤오미 pay any Nov 1, 2016 · 먹튀 신고 Uploaded by Big Time Gaming 파워볼 밸런스 사이트 벳무브

    ReplyDelete
  4. Casino de Monte-Carlo, Monaco | FilmfileEurope
    Casino de 토토사이트 검증 샤오미 Monte-Carlo, Monaco. Casino de Monte-Carlo, Monaco. 아이탬매니아 Theatre of this film was 스포츠토토 사이트 샤오미 established in 1989 스포츠토토 언오버 비코리아 놀검소 and the film is based 엠 오엠 on a fictional tale.

    ReplyDelete

Post a Comment