diff --git a/file/nodejs/express-lfr.yaml b/file/nodejs/express-lfr.yaml index d499b5843d..6f1f0e5b4e 100644 --- a/file/nodejs/express-lfr.yaml +++ b/file/nodejs/express-lfr.yaml @@ -1,7 +1,7 @@ id: express-lfr info: - name: Express LFR + name: Express - Local File Read author: me_dheeraj (https://twitter.com/Dheerajmadhukar) severity: info description: Untrusted user input in express render() function can result in arbitrary file read if hbs templating is used. diff --git a/file/nodejs/generic-path-traversal.yaml b/file/nodejs/generic-path-traversal.yaml index 87ba851bda..8b06ffa1cd 100644 --- a/file/nodejs/generic-path-traversal.yaml +++ b/file/nodejs/generic-path-traversal.yaml @@ -1,7 +1,7 @@ id: generic-path-traversal info: - name: Generic Path Traversal + name: Generic - Path Traversal author: me_dheeraj (https://twitter.com/Dheerajmadhukar) severity: info description: Untrusted user input in readFile()/readFileSync() can endup in Directory Traversal Attacks. @@ -18,4 +18,4 @@ file: - "[^\\.]*\\.readFile\\([^\\)]*\\, <[\\s\\S]*?\\> [^\\)]*\\)" - "[^\\.]*\\.readFileSync\\([^\\)]*\\, <[\\s\\S]*?\\> [^\\)]*\\)" - "[^\\.]*\\.readFileAsync\\([^\\)]*\\, <[\\s\\S]*?\\> [^\\)]*\\)" - condition: or + condition: or \ No newline at end of file diff --git a/file/nodejs/tar-path-overwrite.yaml b/file/nodejs/tar-path-overwrite.yaml index 241491c97c..22dc649a1f 100644 --- a/file/nodejs/tar-path-overwrite.yaml +++ b/file/nodejs/tar-path-overwrite.yaml @@ -1,7 +1,7 @@ -id: tar-path-overwrite +id: tar-extraction info: - name: Tar Path Overwrite + name: Path Injection Vulnerability in TAR Extraction author: me_dheeraj (https://twitter.com/Dheerajmadhukar) severity: info description: Insecure TAR archive extraction can result in arbitrary path over write and can result in code injection. @@ -18,4 +18,4 @@ file: - "[\\w\\W]+?\\.createWriteStream\\([\\w\\W]*?\\, [\\w\\W]*?\\)" - "[\\w\\W]+?\\.writeFile\\([\\w\\W]*?\\, [\\w\\W]*?\\)" - "[\\w\\W]+?\\.writeFileSync\\([\\w\\W]*?\\, [\\w\\W]*?\\)" - condition: or + condition: or \ No newline at end of file