Lucene search

Veracode Vulnerability DatabaseVERACODE:45159

HistoryJan 24, 2024 - 2:03 p.m.

Path Traversal

2024-01-2414:03:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

path traversal

node server

string validation

request url

arbitrary files

static server

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.6%

JSON

@hono/node-server is vulnerable to Path Traversal. The vulnerability is due to improper url string validation in src/request.ts, allowing an attacker to use .. in the request URL to access arbitrary files on the static server.

CPENameOperatorVersion
@hono/node-serverle1.4.0
@hono/node-serverle1.4.0

CPE	Name	Operator	Version
	@hono/node-server	le	1.4.0
	@hono/node-server	le	1.4.0

References

github.com/honojs/node-server/blob/8cea466fd05e6d2e99c28011fc0e2c2d3f3397c9/src/request.ts#L43-L45

github.com/honojs/node-server/commit/dd9b9a9b23e3896403c90a740e7f1f0892feb402

github.com/honojs/node-server/security/advisories/GHSA-rjq5-w47x-x359

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.6%

JSON

Related for VERACODE:45159