Swarm.js - Arbitrary File Write vulnerability

[shaunazzopardi]

Expected behavior

No high vulnerabilities.

Actual behavior

Getting an Arbitrary File Write vulnerability.

Steps to reproduce the behavior

1. npm install web3
2. npm audit

Logs

  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   web3                                                          

  Path            web3 > web3-bzz > swarm-js > decompress                       

  More info       https://npmjs.com/advisories/1217   

Versions

Web3 1.2.6

[cgewecke]

@shaunazzopardi Thanks for reporting.

It looks like neither swarm-js or decompress are being actively developed, unfortunately.

The underlying issue is being tracked at decompress #76.

[cgewecke]

For near-term maintenance purposes we could fork swarm-js to the web3-js org (or ethereumjs) and move decompress to development dependencies. Believe it's only used in a script to generate archive entries and is incidental to the library methods.

Longer term options include migrating swarm support to the erebos api or just deprecating it altogether.

[evertonfraga]

I probably still have push access to the repo and can get npm permissions. Want me to perform those changes at swarm-js then?

…

On Tue, Mar 3, 2020 at 2:37 PM cgewecke ***@***.***> wrote: For near-term maintenance purposes we could fork swarm-js to the web3-js org (or ethereumjs) and move decompress to development dependencies. Believe it's only used in a script to generate archive entries <https://github.com/MaiaVictor/swarm-js/blob/master/scripts/prepareArchives.js> and is incidental to the library methods. Longer term options include migrating swarm support to the erebos api <https://github.com/MainframeHQ/erebos> or just deprecating it altogether. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#3399>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAALQBBHFJFQADSL7VL2WZDRFVL6FANCNFSM4K7NSI3Q> .

[cgewecke]

@evertonfraga Ah that would be great! I saw commits by you but didn't see another publish.

[cgewecke]

@evertonfraga Opened swarm-js 36 for that change.

[evertonfraga]

I published swarm-js 0.1.40. please check!

[cgewecke]

@evertonfraga LGTM!

+ swarm-js@0.1.40
added 169 packages from 119 contributors and audited 356 packages in 18.645s
found 0 vulnerabilities

[evertonfraga]

That's great :)

if you need anything else in that front, lmk!

[holgerd77]

@cgewecke @evertonfraga Hi guys, greetings from EthCC, you are missed! 🥰 Thanks for keeping up on the real-work-to-be-done-front!