CVE-2014-3744 PoC — Joyent Node.js st模块路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-3744.yaml

Associated Vulnerability

Title:Joyent Node.js st模块路径遍历漏洞 (CVE-2014-3744)
Description:Joyent Node.js是美国Joyent公司的一套建立在Google V8 JavaScript引擎之上的网络应用平台。st module是其中的一个用于提供静态文件的节点模块。 Joyent Node.js中的st模块0.2.5之前的版本中存在目录遍历漏洞。远程攻击者可借助路径中的‘%2e%2e（加密的‘..’）’利用该该漏洞读取任意文件。

Description

A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.

File Snapshot


 id: CVE-2014-3744

info:
  name: Node.js st module Directory Traversal
  author: geeknik
  severity:

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!