CVE-2017-16210: Directory Traversal in jn_jj_server
Summary
CVE-2017-16210: Directory Traversal in jn_jj_server. Affects jn_jj_server versions < 0.0.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jn_jj_server package is an npm package used for local development. It provides functionality for resolving relative file paths. However, versions of jn_jj_server prior to 0.0.9 are vulnerable to a directory traversal vulnerability. This vulnerability allows a malicious actor to access files outside of the intended directory root, potentially leading to the disclosure of private files on the vulnerable system.
Vulnerability Detail
The directory traversal vulnerability in jn_jj_server arises from the package's improper handling of relative file paths. By exploiting this vulnerability, an attacker can craft a request that includes a path traversal sequence (e.g., ../) to access files outside of the intended directory. For example, an attacker could send a GET request to access the /etc/passwd file on the system. This can result in the unauthorized disclosure of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The jn_jj_server package has a directory traversal vulnerability that allows unauthorized access to files outside of the intended directory root. No patch is available for this vulnerability, so it is recommended to use the package only for local development purposes. If the functionality is needed for production, switch to a different package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for jn_jj_server →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of private files on the vulnerable system.
No, there is no patch available for this vulnerability.
Yes, this vulnerability can be exploited remotely by sending crafted requests to the vulnerable server.
If you are using the jn_jj_server package, it is recommended to only use it for local development purposes. If the functionality provided by jn_jj_server is required for production, switch to a different package that does not have this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the package-lock.json file.
