PT-2018-4708 · Restafary · Restafary

Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10528

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions restafary versions prior to 1.6.1

Description The issue concerns a directory traversal vulnerability. When a root path is specified in the configuration, the vulnerability allows access beyond the intended directory. This can be exploited by manipulating the URL path to access files outside the specified root directory. For example, using the API endpoint "http://localhost:8000/api/v1/fs/.." to access sensitive files such as "/etc/passwd".

Recommendations Update to version 1.6.1 or later. As a temporary workaround, consider restricting access to the API endpoint "/api/v1/fs/" to minimize the risk of exploitation. Avoid using the ".." notation in the URL path for the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2016-10528

GHSA-XG5R-8J97-2WRJ

Produtos afetados

Restafary

Referências · 6

• 🔥 https://nodesecurity.io/advisories/89 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10528 · Aviso do Fabricante
• https://npmjs.com/advisories/89 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10528 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xg5r-8j97-2wrj · Aviso do Fabricante
• https://github.com/advisories/GHSA-xg5r-8j97-2wrj · Nota