CVE-2014-3744

HIGH NUCLEI

Nodejs Node.js < 0.2.4 - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.

Exploits (1)

github WORKING POC 6 stars

by AikidoSec · javascriptpoc

https://github.com/AikidoSec/zen-0-days/tree/main/node/CVE-2014-3744

View Code ZIP pw:eip

Nuclei Templates (1)

Node.js st module Directory Traversal

HIGHby geeknik

Shodan: cpe:"cpe:2.3:a:nodejs:node.js"

References (5)

[Mailing List] http://www.openwall.com/lists/oss-security/2014/05/13/1

[Mailing List] http://www.openwall.com/lists/oss-security/2014/05/15/2

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/67389

[Third Party Advisory] https://github.com/isaacs/st

View Writeup ZIP pw:eip

[Third Party Advisory] https://nodesecurity.io/advisories/st_directory_traversal

Scores

CVSS v3 7.5

EPSS 0.8075

EPSS Percentile 99.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-22

Status draft

Affected Products (2)

nodejs/node.js < 0.2.4

npm/st < 0.2.5npm

Timeline

Published Oct 23, 2017

Tracked Since Feb 18, 2026