Directory Traversal Affecting geddy package, versions <13.0.8
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.95% (84th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:geddy:20150727
- published 27 Jul 2015
- disclosed 27 Jul 2015
- credit Vikram Chaitanya
Introduced: 27 Jul 2015
CVE-2015-5688 Open this link in a new tabHow to fix?
Update to version >= 13.0.8
Overview
Geddy static file serving allows directory traversal with a URI encoded path.
Source: Node Security Project
Details
Example:
http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
geddy is serving the output as it doesn't match the routes and it's a static file
CVSS Scores
version 3.1