PT-2019-17652 · Unknown · Localhost-Now

Published 2019-03-17 · Updated 2019-10-09 · CVE-2019-5416

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions localhost-now version 1.0.2 localhost-now versions prior to a fixed version (no fixed version specified)

Description A path traversal issue allows attackers to read the content of arbitrary files on the remote server. The package fails to sanitize URLs, enabling attackers to access server files outside of the served folder using relative paths.

Recommendations For version 1.0.2, consider using an alternative package until a fix is made available. For versions prior to a fixed version, consider using an alternative package until a fix is made available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-5416

GHSA-QWJ8-P662-3M7X

Affected Products

Localhost-Now

References · 6

• 🔥 https://hackerone.com/reports/334837 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5416 · Security Note
• https://osv.dev/vulnerability/GHSA-qwj8-p662-3m7x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5416 · Vendor Advisory
• https://github.com/advisories/GHSA-qwj8-p662-3m7x · Note
• https://npmjs.com/advisories/1005 · Note