.. / CVE-2017-14849

Exploit for Node.js <8.6.0 - Directory Traversal (CVE-2017-14849)

Description:

Node.js before 8.6.0 allows remote attackers to access unintended files because a change to “..” handling is incompatible with the pathname validation used by unspecified community modules.

Nuclei Template

View the template here CVE-2017-14849.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2017/CVE-2017-14849.yaml
Copy

References:

https://github.com/Elsfa7-110/kenzer-templates
https://twitter.com/nodejs/status/913131152868876288
https://nvd.nist.gov/vuln/detail/CVE-2017-14849
https://github.com/ARPSyndicate/kenzer-templates
https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/