CVE-2022-24785 PoC — Path Traversal in Moment.js

Source

https://github.com/pS3ud0RAnD0m/cve-2022-24785-poc-lab

Associated Vulnerability

Title: Path Traversal in Moment.js (CVE-2022-24785)
Description:Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Description

Moment.js vuln lab

Readme

## Overview
This is a simple Node Express app used to explore Moment.js' path traversal vuln (CVE-2022-24785).

## Setup
```bash
git clone https://github.com/pS3ud0RAnD0m/momentjs.git
cd momentjs
cat package.json # Change 'moment' to '2.29.4' if wanting to test bypasses of the current patch.
npm install
node app.js
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →