POJIA破甲
地图 / http-live-simulator npm module is prone to path traversal attacks

http-live-simulator npm module is prone to path traversal attacks

路径遍历 / 路径遍历 / #384939

厂商
Node.js third-party modules
严重程度
中危 · CVSS 8.6
赏金
—
弱点
路径遍历
研究员
@lirantal
披露日期
2018-09-18
资产
http-live-simulator
CVE
CVE-2019-5423

该报告还没有中文解读。

原文摘录

摘自原文(2013 字符中的一小部分)
> NOTE! Thanks for submitting a report! Please replace *all* the [square] sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report!

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Node.js third-party modules 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @lirantal · 版权归作者与 Node.js third-party modules 所有

同类报告

Arbitrary file read via the UploadsRewriter when moving and issueGitLab · 2020-04-27 · $20,000Arbitrary file read via the bulk imports UploadsPipelineGitLab · 2022-03-21 · $29,000Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted dataStarbucks · 2020-06-16Arbitrary file read during project importGitLab · 2021-05-24 · $16,000Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingPortSwigger Web Security · 2026-06-14 · $5,000Path traversal in filename in LINE Mac clientLY Corporation · 2020-07-31