CVE-2017-0930: Directory Traversal in augustine
6.5
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.65676%
CWE
Published
9/18/2018
Updated
9/8/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
augustine | npm | <= 0.2.3 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from improper path resolution when handling user-supplied URLs. The proof of concept (GET //etc/passwd
) demonstrates that the server resolves absolute paths outside the intended root directory. In Node.js static file servers, this typically occurs in the request handler where the URL is directly mapped to the filesystem using path.join
or path.resolve
without checks for path traversal. The lack of normalization or validation against absolute paths or directory traversal sequences (e.g., ../
) makes this function vulnerable. While the exact code isn't provided, the described behavior and common implementation patterns in static file servers justify high confidence in this assessment.