CVE-2017-10974 Path traversal in n/a
Unauthenticated attackers can read arbitrary files from the Yaws web server by using encoded backslashes to bypass directory traversal protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-10974?
CVE-2017-10974 is a high-severity path traversal vulnerability in n/a, published on 7 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial /%5C sequence to defeat traversal protection mechanisms; the initial /%5C sequence was apparently not discussed in earlier research on this product.
Weakness: CWE-22
Which versions are affected by CVE-2017-10974?
It affects 1 product.
Products include Yaws Yaws.
How do I fix CVE-2017-10974?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-10974 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-10974 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2017-10974, GHSA-jxfg-w2gp-7257.