CVE-2017-16125: Directory Traversal in rtcmulticonnection-client
Summary
CVE-2017-16125: Directory Traversal in rtcmulticonnection-client. Affects rtcmulticonnection-client versions < 1.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rtcmulticonnection-client package is an npm package used for real-time communication between clients. It provides functionality for establishing peer-to-peer connections and transmitting data. This vulnerability affects versions of rtcmulticonnection-client up to and including 1.0.5.
Vulnerability Detail
Affected versions of rtcmulticonnection-client suffer from a directory traversal vulnerability. This vulnerability arises from the package's resolution of relative file paths, which allows a malicious actor to access files outside of the intended directory root. Exploiting this vulnerability can lead to the disclosure of private files on the vulnerable system. An example request that demonstrates this vulnerability is:
GET /../../../etc/passwd HTTP/1.1
host: foo
This vulnerability has a severity rating of HIGH and is classified under CWE-22.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, a possible workaround is to manually validate and sanitize user input to prevent directory traversal attacks. This can be achieved by ensuring that file paths are restricted to the intended directory root and disallowing any attempts to access files outside of this root directory.
Conclusion
The rtcmulticonnection-client package suffers from a directory traversal vulnerability that allows an attacker to access files outside of the intended directory root. No patch is available for this vulnerability, so it is recommended to use the package only for local development purposes. If the functionality is required for production, it is advised to switch to a different package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rtcmulticonnection-client →
FAQ
This vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
No, there is no patch available for this vulnerability at the moment.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the vulnerable system.
This vulnerability has a severity rating of HIGH.
There are no known instances of this vulnerability being exploited in the wild.
