Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-16185

CVE-2017-16185:
Directory Traversal in uekw1511server

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2017-16185
GHSA ID
GHSA-pm44-7gw9-6g8p
EPSS Score
0.67352%
CWE
CWE-22
Published
9/1/2020
Updated
9/12/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
uekw1511servernpm>= 0.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path sanitization when handling user-supplied URLs. The server likely uses a function that directly maps URL paths to filesystem paths using raw input (e.g., via path.join or string concatenation) without validation. This matches the observed exploit pattern where '../' sequences bypass directory restrictions. While the exact implementation details aren't provided, the described vulnerability pattern strongly indicates a flawed request handling function common in static file servers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* `u*kw****s*rv*r` r*solv* r*l*tiv* *il* p*t*s, r*sultin* in * *ir**tory tr*v*rs*l vuln*r**ility. * m*li*ious **tor **n us* t*is vuln*r**ility to ****ss *il*s outsi** o* t** int*n*** *ir**tory root, w*i** m*y r*sult in t** *is*losu

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* s*nitiz*tion w**n **n*lin* us*r-suppli** URLs. T** s*rv*r lik*ly us*s * *un*tion t**t *ir**tly m*ps URL p*t*s to *il*syst*m p*t*s usin* r*w input (*.*., vi* `p*t*.join` or strin* *on**t*n*tion) wit*out v*li*