PT-2015-7035 · Mikael Rogers · Geddy

Phanect · Publicado 2015-09-04 · Atualizado 2017-10-24 · CVE-2015-5688

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Geddy versions prior to 13.0.8

Description A directory traversal issue allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH INFO to the default URI. This can be exploited by sending a specially crafted request to the server, potentially allowing access to sensitive files. For example, an attacker could use a URL like "http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" to attempt to read the /etc/passwd file.

Recommendations Update Geddy to version 13.0.8 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-5688

GHSA-333X-9VGQ-V2J4

Produtos afetados

Geddy

Referências · 10

• 🔥 https://github.com/geddy/geddy/issues/697 · Exploit
• 🔥 https://nodesecurity.io/advisories/geddy-directory-traversal · Exploit
• https://github.com/geddy/geddy/pull/699 · Nota
• https://github.com/geddy/geddy/releases/tag/v13.0.8 · Correção
• https://github.com/geddy/geddy · Nota
• https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231 · Nota
• https://npmjs.com/advisories/10 · Nota
• https://github.com/advisories/GHSA-333x-9vgq-v2j4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5688 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-333x-9vgq-v2j4 · Aviso do Fabricante