REDHAT-BUG-2510719: High severity PostCSS PostCSS vulnerability
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostCSSto a version that resolves this vulnerability.Fixed in 8.5.19
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using PostCSS versions prior to 8.5.19 are exposed when the `from` option is unset and an attacker can supply a CSS sourceMappingURL.
What must an attacker control to exploit the issue?
The attacker needs to provide an absolute-path or directory-traversal sourceMappingURL in CSS processed by PostCSS. This can cause PreviousMap.loadFile() to load an unintended source-map file.
What information can be disclosed?
The loaded source map's `sources` and `sourcesContent` fields may be exposed to the application, potentially disclosing source paths and embedded source content.
What is the remediation?
Upgrade PostCSS to version 8.5.19, which fixes the issue. If an upgrade cannot be applied immediately, do not process attacker-controlled CSS with `from` unset, and restrict or reject absolute and directory-traversal sourceMappingURL values.