PT-2015-7035 · Mikael Rogers · Geddy

Phanect · Published 2015-09-04 · Updated 2017-10-24 · CVE-2015-5688

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Geddy versions prior to 13.0.8

Description A directory traversal issue allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH INFO to the default URI. This can be exploited by sending a specially crafted request to the server, potentially allowing access to sensitive files. For example, an attacker could use a URL like "http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd" to attempt to read the /etc/passwd file.

Recommendations Update Geddy to version 13.0.8 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-5688

GHSA-333X-9VGQ-V2J4

Affected Products

Geddy

References · 10

• 🔥 https://github.com/geddy/geddy/issues/697 · Exploit
• 🔥 https://nodesecurity.io/advisories/geddy-directory-traversal · Exploit
• https://github.com/geddy/geddy/releases/tag/v13.0.8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-5688 · Security Note
• https://osv.dev/vulnerability/GHSA-333x-9vgq-v2j4 · Vendor Advisory
• https://github.com/geddy/geddy/pull/699 · Note
• https://github.com/geddy/geddy · Note
• https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231 · Note
• https://npmjs.com/advisories/10 · Note
• https://github.com/advisories/GHSA-333x-9vgq-v2j4 · Note