PT-2018-16157 · Unknown · Crud-File-Server

Bl4De + 1 · CVE-2018-3733 · Publicado 2018-05-29 · Atualizado 2023-02-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions crud-file-server versions prior to 0.9.0

Description The issue arises from incorrect validation of URLs, allowing a malicious user to read the content of any file with a known path due to a Path Traversal vulnerability. This is because the package fails to sanitize URLs, enabling attackers to access server files outside of the served folder using relative paths.

Recommendations Upgrade to version 0.9.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-3733

GHSA-VFP9-GWRH-WQ9G

Produtos afetados

Crud-File-Server

Referências · 7

• 🔥 https://hackerone.com/reports/310690 · Exploit
• https://github.com/omphalos/crud-file-server/commit/4fc3b404f718abb789f4ce4272c39c7a138c7a82 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-3733 · Nota de Segurança
• https://npmjs.com/advisories/1003 · Nota
• https://github.com/advisories/GHSA-vfp9-gwrh-wq9g · Nota
• https://osv.dev/vulnerability/CVE-2018-3733 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vfp9-gwrh-wq9g · Aviso do Fabricante