Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-16110

CVE-2017-16110:
Directory Traversal in weather.swlyons

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2017-16110
GHSA ID
GHSA-2r4h-2ghh-5hpx
EPSS Score
0.67352%
CWE
CWE-22
Published
9/1/2020
Updated
9/11/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
weather.swlyonsnpm>= 0.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure handling of user-controlled input in the URL path. The server resolves the raw URL path (e.g., /../../../../etc/passwd) without sanitizing traversal sequences (../), enabling access to arbitrary files. This behavior is typically implemented in the core request-handling function of the server (e.g., in server.js), where the URL path is directly used to construct filesystem paths. The lack of patch and the explicit example request further confirm this pattern.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* `w**t**r.swlyons` r*solv* r*l*tiv* *il* p*t*s, r*sultin* in * *ir**tory tr*v*rs*l vuln*r**ility. * m*li*ious **tor **n us* t*is vuln*r**ility to ****ss *il*s outsi** o* t** int*n*** *ir**tory root, w*i** m*y r*sult in t** *is*los

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* **n*lin* o* us*r-*ontroll** input in t** URL p*t*. T** s*rv*r r*solv*s t** r*w URL p*t* (*.*., `/../../../../*t*/p*ssw*`) wit*out s*nitizin* tr*v*rs*l s*qu*n**s (`../`), *n**lin* ****ss to *r*itr*ry *il*s. T*is *