henszey / etcd-browser

A quick and easy way to view/edit basic keys in etcd.
http://henszey.github.io/etcd-browser/
MIT License
672 stars 232 forks source link

Security Issue Identified #35

Open KevinRandall1337 opened 1 year ago

KevinRandall1337 commented 1 year ago

Hello Developers:

Upon doing some security research, I have identified an issue pertaining to the server.js file of etcd-browser.

The application is vulnerable to a directory traversal vulnerability. This was identified from the docker instance found here: https://hub.docker.com/r/buddho/etcd-browser

This was installed on my local laptop. The issue identified is a Directory Traversal vulnerability where the server runs (Ex: Default port of 8000) Evidence available upon request. Directories accessed include: /etc/ and /proc along with others. Looking forward to hearing back.