GHSA-cv3v-7846-6pxm: 
JavaScript vulnerability analysis and mitigation

A high-severity unauthorized file access vulnerability was discovered in node-git-server versions prior to 0.6.1. The vulnerability was disclosed on October 14, 2019, and published to various security databases. The vulnerability affects the node-git-server package, which is a configurable git server written in Node.js (GitHub Advisory, Snyk Report).

The vulnerability allows attackers to access any git repository by using absolute paths, potentially exposing private repositories. The issue stems from the path.resolve method prioritizing the second argument, which means when a repository name starts with '/', it can overwrite the repoDir parameter. For example, path.resolve('/my/repo/folder','/etc') would resolve to '/etc'. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (High), with the following metrics: Network attack vector, Low attack complexity, No privileges required, No user interaction, Unchanged scope, High confidentiality impact, and No impact on integrity or availability (GitHub Advisory, GitHub PR).

The vulnerability enables attackers to access private repositories through arbitrary absolute paths. This could lead to unauthorized access to sensitive repository data and potentially impact authentication mechanisms by corrupting repository names (Snyk Report, GitHub PR).

The vulnerability can be exploited by sending repository names that start with '/' in git commands. For example, an attacker could use 'git clone http://localhost:7005//Users/root/Desktop/testrepo.git ./cloned-from-desktop' to clone a repository from an arbitrary absolute path. The same technique could be used for git push/pull operations (GitHub PR).

The vulnerability has been patched in version 0.6.1 of node-git-server. The fix involves changing the path resolution method from path.resolve to path.join to prevent directory traversal. Users are recommended to upgrade to version 0.6.1 or later (GitHub Advisory, GitHub Commit).