GHSA-73cw-jxmm-qpgh Path Traversal in localhost-now
Attackers can read arbitrary files from the server via path traversal in the localhost-now library, requiring immediate removal of the module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-73cw-jxmm-qpgh?
GHSA-73cw-jxmm-qpgh is a path traversal vulnerability in localhost-now, published on 11 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2
Proof of concept:
$ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd"
Recommendation
No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Which versions are affected by GHSA-73cw-jxmm-qpgh?
2 open source packages ship an affected version, including localhost-now.
| Package | Affected | Fixed in |
|---|---|---|
localhost-now npm | All versions to 1.0.2 | None |
localhost-now npm | All versions to 1.0.2 | None |
How do I fix GHSA-73cw-jxmm-qpgh?
No fix has been published for GHSA-73cw-jxmm-qpgh yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-73cw-jxmm-qpgh being exploited?
There is no known exploitation of GHSA-73cw-jxmm-qpgh in the wild and no public exploit code.