Is CVE-2018-3729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-3729 being exploited in the wild.

How severe is CVE-2018-3729?

Low severity, with a CVSS score of 3.1, published 25 July 2018.

Which products and versions are affected?

localhost-now (npm) SEMVER:introduced=0,fixed=1.0.2.

Is there a fix for CVE-2018-3729?

Yes. localhost-now (npm): upgrade to 1.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-3729 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-3729?

Check whether you run localhost-now (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-3729: DCKT localhost-now path traversal

CVE-2018-3729 · Severity: low · CVSS 3.1 · Published 2018-07-25

localhost-now is a Node.js module used to serve local files over a network. A security flaw in versions prior to 1.0.2 allows an attacker to bypass directory restrictions and access any file on the host system that the application has permission to read. This could lead to the exposure of sensitive configuration files, credentials, or private data, potentially compromising the entire server.

Technologies: localhost-now (npm). Vendors: npm.

Quick answers

Is CVE-2018-3729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-3729 being exploited in the wild.
How severe is CVE-2018-3729?: Low severity, with a CVSS score of 3.1, published 25 July 2018.
Which products and versions are affected?: localhost-now (npm) SEMVER:introduced=0,fixed=1.0.2.
Is there a fix for CVE-2018-3729?: Yes. localhost-now (npm): upgrade to 1.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-3729 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-3729?: Check whether you run localhost-now (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

localhost-now (npm): upgrade to 1.0.2 or later
```
npm install localhost-now@1.0.2
```

Technical details

The localhost-now Node.js module is vulnerable to a path traversal attack (CWE-22) in versions prior to 1.0.2. The vulnerability stems from a lack of proper validation or sanitization of user-supplied input used to construct file paths. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests containing directory traversal sequences (e.g., '../'). This allows the attacker to escape the intended web root directory and read the contents of arbitrary files on the server's filesystem. The issue was addressed in version 1.0.2 by implementing path validation.

Affected products

DCKT localhost-now < 1.0.2

Identifiers

CVE-2018-3729
GHSA-2gjg-5x33-mmp2

Timeline

2018-06-06: advisory: NVD published CVE-2018-3729
2018-07-25: disclosed: GHSA-2gjg-5x33-mmp2 published
2018-07-25: patched: Fix committed in version 1.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.