CVE-2024-57186: 
JavaScript vulnerability analysis and mitigation

CVE-2024-57186 is a path traversal vulnerability discovered in Erxes versions prior to 1.6.2. The vulnerability affects the /read-file endpoint handler in the core service of Erxes, an open-source experience management solution. The issue was discovered in March 2024 and allows unauthenticated attackers to read arbitrary files from the system (Sonar Blog, NVD).

The vulnerability exists in the readFileRequest() function that handles the /read-file endpoint. The function accepts a 'key' parameter from user input without proper validation and uses it to construct filesystem paths. An attacker can exploit this by using relative path traversal sequences (../) to access files outside the intended directory. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (Sonar Blog, NVD).

The vulnerability allows attackers to read sensitive files from the system, including configuration files and environment variables that may contain authentication secrets and database credentials. In the context of Erxes' microservices architecture, this could lead to exposure of critical system information and potentially enable further attacks (Sonar Blog).

The vulnerability has been patched in Erxes version 1.6.2 by implementing proper filename sanitization. Users are strongly recommended to upgrade to version 1.6.2 or later to address this security issue (Erxes Commit).