Executive brief
wind-mvc is a Node.js web framework used for building web applications. A directory traversal vulnerability allows attackers to access arbitrary files on the server outside the intended application directory, potentially exposing sensitive system files and private configuration data.
Technical details
wind-mvc contains a directory traversal vulnerability (CWE-22) where relative file paths are not properly validated, allowing an attacker to use path traversal sequences (e.g., "../../") to escape the intended directory root. The vulnerability is network-accessible without authentication and can be exploited through specially crafted HTTP requests to read arbitrary files on the system. An attacker can retrieve sensitive files such as /etc/passwd, configuration files, or private keys. No patch is available; the advisory recommends restricting the package to local development use only.
Affected products
- wind-mvc wind-mvc 0.0.0 and later
Timeline
- 2017: disclosed: CVE-2017-16220 assigned
- 2020-09-01: advisory: GHSA-7g8m-5qh9-9pgw published