Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-16109

CVE-2017-16109:
Directory Traversal in easyquick

5.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2017-16109
GHSA ID
GHSA-8h55-49jm-739x
EPSS Score
0.41533%
CWE
CWE-22
Published
8/29/2018
Updated
9/11/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
easyquicknpm<= 0.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

While no specific code is available, directory traversal vulnerabilities in Node.js servers typically stem from: 1) Unsanitized user input being used directly in filesystem operations 2) Lack of path normalization before file access. The vulnerability pattern matches classic cases where user-supplied paths (from req.url) are joined with a base directory without proper validation. The high confidence comes from the consistent vulnerability description across multiple sources and the well-understood nature of this vulnerability pattern in web servers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* `**syqui*k` r*solv* r*l*tiv* *il* p*t*s, r*sultin* in * *ir**tory tr*v*rs*l vuln*r**ility. * m*li*ious **tor **n us* t*is vuln*r**ility to ****ss *il*s outsi** o* t** int*n*** *ir**tory root, w*i** m*y r*sult in t** *is*losur* o*

Reasoning

W*il* no sp**i*i* *o** is *v*il**l*, *ir**tory tr*v*rs*l vuln*r**iliti*s in `No**.js` s*rv*rs typi**lly st*m *rom: *) Uns*nitiz** us*r input **in* us** *ir**tly in *il*syst*m op*r*tions *) L**k o* p*t* norm*liz*tion ***or* *il* ****ss. T** vuln*r**il