GitHub Advisoryadvisory · npm
GHSA-4wch-fwmx-cf47 Directory Traversal in augustine
MEDIUM
Official page ↗
- Aliases
- CVE-2017-0930
- Ecosystem
- npm
- Packages
- augustine
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2020-06-16
Affected packages
• npm augustine: <= 0.2.3 (no fix yet)
Description
Affected versions of `augustine` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.
Proof of Concept
```http
GET //etc/passwd HTTP/1.1
host:foo
```
Recommendation
No direct patch is available at this time.
Currently, the best mitigation for this flaw is to use a different, functionally equivalent static file server package.
Related
Alias · CVE (1)
- CVE-2017-0930 augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness