Miggo Logo

CVE-2017-0930: Directory Traversal in augustine

6.5

CVSS Score
3.0

Basic Information

EPSS Score
0.65676%
Published
9/18/2018
Updated
9/8/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
augustinenpm<= 0.2.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path resolution when handling user-supplied URLs. The proof of concept (GET //etc/passwd) demonstrates that the server resolves absolute paths outside the intended root directory. In Node.js static file servers, this typically occurs in the request handler where the URL is directly mapped to the filesystem using path.join or path.resolve without checks for path traversal. The lack of normalization or validation against absolute paths or directory traversal sequences (e.g., ../) makes this function vulnerable. While the exact code isn't provided, the described behavior and common implementation patterns in static file servers justify high confidence in this assessment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* `*u*ustin*` r*solv* r*l*tiv* *il* p*t*s, r*sultin* in * *ir**tory tr*v*rs*l vuln*r**ility. * m*li*ious **tor **n us* t*is vuln*r**ility to ****ss *il*s outsi** o* t** int*n*** *ir**tory root, w*i** m*y r*sult in t** *is*losur* o*

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* r*solution w**n **n*lin* us*r-suppli** URLs. T** proo* o* *on**pt (`**T //*t*/p*ssw*`) **monstr*t*s t**t t** s*rv*r r*solv*s **solut* p*t*s outsi** t** int*n*** root *ir**tory. In No**.js st*ti* *il* s*rv*rs