p PatchFirst

CVE-2024-49770

CVE-2024-49770 · oak's path traversal allows transfer of hidden files within the served root directory

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

`oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow transferring of hidden files with `Context.send` API. However, prior to version 17.1.3, this can be bypassed by encoding `/` as its URL encoded form `%2F`. For an attacker this has potential to read sensitive user data or to gain access to server secrets. Version 17.1.3 fixes the issue.

CVSS 7.7 · Élevée · EPSS 0,7%

Publication
Mise à jour

Pile logicielle: node

Produits et versions concernés

  • oak

    Versions du logiciel
    • < 17.1.3: Concernée

    Aucun correctif publié

  • @oakserver/oak npm

    Plages de versions concernées
    • SEMVER: ≤ 14.1.0

    Aucun correctif publié

Sources originales

Vérifiez votre serveur →