Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0)

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• tp-link archer c5 firmwarebefore 150317
• tp-link archer c7 firmwarebefore 150304
• tp-link archer c8 firmwarebefore 150316
• tp-link archer c9 firmwarebefore 150302
• tp-link tl-wdr3500 firmwarebefore 150302
• tp-link tl-wdr3600 firmwarebefore 150302
• tp-link tl-wdr4300 firmwarebefore 150302
• tp-link tl-wr740n firmwarebefore 150312
• tp-link tl-wr741nd firmwarebefore 150312
• tp-link tl-wr841n firmwarebefore 150310
• tp-link tl-wr841nd firmwarebefore 150310

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.