Executive brief
The wenluhong1 package is a utility used in web development that is vulnerable to directory traversal. This flaw allows an unauthorized person to access sensitive files on the server that should be private, such as system configuration files or application source code. Because there is no official fix available, it is recommended to stop using this package in production environments.
Technical details
The wenluhong1 package fails to properly sanitize input when resolving file paths, leading to a directory traversal vulnerability (CWE-22). A remote, unauthenticated attacker can exploit this by sending HTTP GET requests containing 'dot-dot-slash' (../) sequences or their URL-encoded equivalents (%2e%2e%2f). This allows the attacker to escape the intended web root directory and read sensitive files, such as /etc/passwd, from the underlying file system. No patch is currently available; the maintainers recommend using the package only for local development or migrating to a secure alternative.
Affected products
- wenluhong1 wenluhong1 All versions
Timeline
- 2017-05-09: disclosed: Vulnerability disclosed by Liang Gong
- 2017-06-07: advisory: Snyk published advisory
- 2020-09-01: advisory: GitHub advisory published