GitHub Advisoryadvisory · npm
GHSA-333x-9vgq-v2j4 Directory Traversal in geddy
HIGH
Official page ↗
- Aliases
- CVE-2015-5688
- Ecosystem
- npm
- Packages
- geddy
- Severity
- High
- Weaknesses
- CWE-22
- Reviewed
- 2020-06-16
Affected packages
• npm geddy: < 13.0.8 → fixed in 13.0.8
Description
Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors.
Proof of Concept
```
http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
```
Recommendation
Update geddy to version >= 13.0.8
Related
Alias · CVE (1)
- CVE-2015-5688 Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-5688 advisory
- https://github.com/geddy/geddy/issues/697 web
- https://github.com/geddy/geddy/pull/699 web
- https://github.com/geddy/geddy/commit/2de63b68b3aa6c08848f261ace550a37959ef231 web
- https://github.com/advisories/GHSA-333x-9vgq-v2j4 advisory
- https://github.com/geddy/geddy package
- https://github.com/geddy/geddy/releases/tag/v13.0.8 web
- https://www.npmjs.com/advisories/10 web