PT-2024-37842 · Naibowang · Naibowang Easyspider

Jiashenghe · Published 2024-07-15 · Updated 2024-07-19 · CVE-2024-6746

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NaiboWang EasySpider version 0.6.2

Description A problematic vulnerability was found in the HTTP GET Request Handler component of NaiboWang EasySpider, specifically in the file server.js. The issue allows for path traversal when an attacker manipulates the input with a sequence like /../../../../../../../../../Windows/win.ini, leading to access to files like '../filedir'. This attack can only be performed within a local network. The exploit for this issue has been publicly disclosed. The software's default operation is local and does not expose it to the internet, which the code maintainer notes mitigates the severity of the issue.

Recommendations For NaiboWang EasySpider version 0.6.2, consider restricting access to the vulnerable HTTP GET Request Handler component until a patch is available. As a temporary workaround, avoid using inputs that could lead to path traversal in the server.js file. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

CWE-24

Related Identifiers

CVE-2024-6746

Affected Products

Naibowang Easyspider

References · 9

• 🔥 https://github.com/NaiboWang/EasySpider/issues/466 · Exploit
• https://osv.dev/vulnerability/CVE-2024-6746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6746 · Security Note
• https://vuldb.com/?ctiid.271477 · Note
• https://vuldb.com/?id.271477 · Note
• https://t.me/cvedetector/862 · Telegram Post
• https://t.me/cvenotify/86787 · Telegram Post
• https://vuldb.com/?submit.371998 · Note
• https://t.me/cvenotify/86206 · Telegram Post