GitHub Advisoryadvisory · npm
GHSA-g7j3-p357-cw8p Directory Traversal in f2e-server
HIGH
Official page ↗
- Aliases
- CVE-2017-16038
- Ecosystem
- npm
- Packages
- f2e-server
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2020-06-16
Affected packages
• npm f2e-server: < 1.12.12 → fixed in 1.12.12
Description
Affected versions of `f2e-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.
Example request:
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```
Recommendation
Update to version 1.12.12 or later.
Related
Alias · CVE (1)
- CVE-2017-16038 `f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../"… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-16038 advisory
- https://github.com/shy2850/node-server/issues/10 web
- https://github.com/shy2850/node-server/pull/12/files web
- https://github.com/advisories/GHSA-g7j3-p357-cw8p advisory
- https://github.com/shy2850/node-server package
- https://www.npmjs.com/advisories/346 web