Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-16125

CVE-2017-16125: Directory Traversal in rtcmulticonnection-client

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2017-16125
GHSA ID
GHSA-vcqg-cmv3-wj57
EPSS Score
0.67323%
CWE
CWE-22
Published
7/23/2018
Updated
9/11/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
rtcmulticonnection-clientnpm<= 1.0.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path sanitization when handling file requests. The example attack uses path traversal sequences in the URL, indicating the server-side file handling logic doesn't normalize paths before accessing files. In Node.js applications, this typically occurs in request handlers that map URLs directly to filesystem paths. The high confidence comes from the vulnerability pattern matching common path traversal flaws where user input isn't properly sanitized before filesystem operations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* `rt*multi*onn**tion-*li*nt` r*solv* r*l*tiv* *il* p*t*s, r*sultin* in * *ir**tory tr*v*rs*l vuln*r**ility. * m*li*ious **tor **n us* t*is vuln*r**ility to ****ss *il*s outsi** o* t** int*n*** *ir**tory root, w*i** m*y r*sult in t

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* s*nitiz*tion w**n **n*lin* *il* r*qu*sts. T** *x*mpl* *tt**k us*s p*t* tr*v*rs*l s*qu*n**s in t** URL, in*i**tin* t** s*rv*r-si** *il* **n*lin* lo*i* *o*sn't norm*liz* p*t*s ***or* ****ssin* *il*s. In No**.j