CVE-2017-16150: Directory Traversal in wangguojing123
Summary
CVE-2017-16150: Directory Traversal in wangguojing123. Affects wangguojing123 versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wangguojing123 package is an npm package used for local development. It provides functionality for resolving relative file paths. However, affected versions of this package have a directory traversal vulnerability. This vulnerability allows a malicious actor to access files outside of the intended directory root, potentially leading to the disclosure of private files on the vulnerable system.
Vulnerability Detail
The directory traversal vulnerability in wangguojing123 arises from the package's improper handling of relative file paths. By exploiting this vulnerability, an attacker can craft requests that traverse directories and access files outside of the intended directory root. For example, an attacker can send a GET request with a specially crafted path to access sensitive files like /etc/passwd. This can result in the unauthorized disclosure of private information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, a workaround for this vulnerability is to manually validate and sanitize user input to prevent directory traversal attacks. This can be done by ensuring that user-supplied file paths are restricted to the intended directory root and do not contain any relative path components.
Conclusion
The wangguojing123 package has a directory traversal vulnerability that allows unauthorized access to files outside of the intended directory root. As there is no patch available, it is recommended to use this package only for local development purposes. For production use, it is advised to switch to a different package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wangguojing123 →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
No, there is no patch available for this vulnerability.
Yes, this vulnerability can be exploited remotely by sending specially crafted requests.
It is recommended to switch to a different package for production use, or restrict the usage of wangguojing123 to local development only.
There are no known instances of this vulnerability being exploited at the moment.
