PT-2018-5157 · Node.Js · Augustine
Ysx
·
Publicado
2018-06-04
·
Atualizado
2019-10-09
·
CVE-2017-0930
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
augustine (affected versions not specified)
Description
The issue arises from a lack of validation of URLs in the augustine node module, leading to a Path Traversal vulnerability. This allows a malicious user to read the content of any file with a known path. A malicious actor can exploit this vulnerability to access files outside of the intended directory root, potentially resulting in the disclosure of private files on the vulnerable system. An example of exploitation is accessing the "/etc/passwd" file.
Recommendations
As a temporary workaround, consider using a different, functionally equivalent static file server package until a patch is available.
Restrict access to sensitive files and directories to minimize the risk of exploitation.
Avoid using the augustine node module for serving static files until the issue is resolved.
Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Augustine