PT-2018-5157 · Node.Js · Augustine

Ysx · Published 2018-06-04 · Updated 2019-10-09 · CVE-2017-0930

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions augustine (affected versions not specified)

Description The issue arises from a lack of validation of URLs in the augustine node module, leading to a Path Traversal vulnerability. This allows a malicious user to read the content of any file with a known path. A malicious actor can exploit this vulnerability to access files outside of the intended directory root, potentially resulting in the disclosure of private files on the vulnerable system. An example of exploitation is accessing the "/etc/passwd" file.

Recommendations As a temporary workaround, consider using a different, functionally equivalent static file server package until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using the augustine node module for serving static files until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-0930

GHSA-4WCH-FWMX-CF47

Affected Products

Augustine

References · 6

• 🔥 https://hackerone.com/reports/296282 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-0930 · Security Note
• https://osv.dev/vulnerability/GHSA-4wch-fwmx-cf47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0930 · Vendor Advisory
• https://github.com/advisories/GHSA-4wch-fwmx-cf47 · Note
• https://npmjs.com/advisories/559 · Note