CVE-2020-7646: 
JavaScript vulnerability analysis and mitigation

curlrequest through version 1.0.1 contains an arbitrary file read vulnerability (CVE-2020-7646) that allows reading any file by populating the file parameter with user input. The vulnerability was published and disclosed on May 7, 2020 (Snyk, NVD).

The vulnerability is classified as CWE-22 (Path Traversal) with a CVSS v3.1 base score of 6.8 (medium) according to Snyk's assessment. The issue allows attackers to read arbitrary files through the file parameter when making requests using the curlrequest library. The vulnerability exists because the library does not properly validate user input when handling file paths (Snyk).

When exploited, this vulnerability can lead to unauthorized access to sensitive files on the system, resulting in a total loss of confidentiality for affected resources. An attacker could potentially read any file accessible to the application, including configuration files, private keys, and other sensitive system files (Snyk).

The vulnerability has a documented proof-of-concept exploit. A simple example demonstrates how an attacker can read arbitrary files by manipulating the file parameter: curl.request({ file: userPayload }, function (err, stdout, meta) { console.log("%s %s", meta.cmd, meta.args.join(" ")); }); where userPayload can be set to any file path like '/etc/passwd' (Snyk).

There is no fixed version available for the curlrequest package. Users are advised to find alternative solutions or implement proper input validation when handling file paths (Snyk).